cfbad8319935aad6bf3a78729c6b0edd24d2c2db60bb06216e73b3b8f5eaa323

Analysis

max time kernel
181s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 17:28

Target

cfbad8319935aad6bf3a78729c6b0edd24d2c2db60bb06216e73b3b8f5eaa323.dll
Size

18KB
MD5

215d3adc9c105dad22137d33e6508ce0
SHA1

4f6533787ffff77577df2a5d07f9d2ac1dd3db12
SHA256

cfbad8319935aad6bf3a78729c6b0edd24d2c2db60bb06216e73b3b8f5eaa323
SHA512

29ba036d8c6e57c02cc8258b6238ac85317a7db9344d5293ac7612ad98679566df20b4b844ace396d02eea47e7a1c5a2c652fb8eb5ccb8afca638093489edae4
SSDEEP

384:/rDKFb+tnPWjtLf8zv7A/wBQvJZgo0vivV+Mfu5:PqatnPWjtLf5YOvHgdv+VTfu5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3104	2068	rundll32.exe	79
PID 2068 wrote to memory of 3104	2068	rundll32.exe	79
PID 2068 wrote to memory of 3104	2068	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfbad8319935aad6bf3a78729c6b0edd24d2c2db60bb06216e73b3b8f5eaa323.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfbad8319935aad6bf3a78729c6b0edd24d2c2db60bb06216e73b3b8f5eaa323.dll,#1
  2⤵
  PID:3104

memory/3104-132-0x0000000000000000-mapping.dmp

Download
memory/3104-133-0x0000000077BA0000-0x0000000077BA6000-memory.dmp

Filesize
24KB

Download
memory/3104-134-0x0000000001580000-0x00000000015C0000-memory.dmp

Filesize
256KB

Download