cf9c471f1af56238c492e650100e8ebd59ca8849a226e80ac6c603e19846eabc

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 20:25

Target

cf9c471f1af56238c492e650100e8ebd59ca8849a226e80ac6c603e19846eabc.dll
Size

91KB
MD5

11fb2ee8ba04be393319fdc0c11f9aa6
SHA1

a03c0a21c4b49195e9f0f7f926b3ad004ba8f9b5
SHA256

cf9c471f1af56238c492e650100e8ebd59ca8849a226e80ac6c603e19846eabc
SHA512

a203d345eef30f756c7ebf83664c6c5994cda73818acbd999ea1eba339efb363dd2dfd1bc518d93379f8bfb2673fe64d1279595c26172977d69afd71c1b71dbb
SSDEEP

1536:TD6K271gp7DXHQ49AXDB9cHvkjnMdGX4DEi0IuyUNEvJdwmy:TDGYLwwODBGYuC4IDI8NWJdLy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2556	2952	rundll32.exe	80
PID 2952 wrote to memory of 2556	2952	rundll32.exe	80
PID 2952 wrote to memory of 2556	2952	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf9c471f1af56238c492e650100e8ebd59ca8849a226e80ac6c603e19846eabc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf9c471f1af56238c492e650100e8ebd59ca8849a226e80ac6c603e19846eabc.dll,#1
  2⤵
  PID:2556

memory/2556-132-0x0000000000000000-mapping.dmp

Download
memory/2556-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download