cf3227fc2bc23d2aa770c4aaa65463838146903a1fb4e4711a6a216e302721b5

Analysis

max time kernel
146s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:26

Target

cf3227fc2bc23d2aa770c4aaa65463838146903a1fb4e4711a6a216e302721b5.dll
Size

68KB
MD5

80ded68d5c7d142abb4a5784c20f6588
SHA1

92e9b062e24bc8c58f10f235a0a78724c2b14cd7
SHA256

cf3227fc2bc23d2aa770c4aaa65463838146903a1fb4e4711a6a216e302721b5
SHA512

2041c8fa743e36fdc044aa023f227c3196947d064fab3bb1d9a47a5771acdd76b745a7cc891ea1472529ec3b0b21f257e5267809b5f97fb2f22015f4cea223b9
SSDEEP

1536:wAceoINVAL4keNvoVaGMA+G2aBudot8C5TsHQqm2l:wAcTqGgRoIGvR7mQqm2l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 628	5080	rundll32.exe	80
PID 5080 wrote to memory of 628	5080	rundll32.exe	80
PID 5080 wrote to memory of 628	5080	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf3227fc2bc23d2aa770c4aaa65463838146903a1fb4e4711a6a216e302721b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf3227fc2bc23d2aa770c4aaa65463838146903a1fb4e4711a6a216e302721b5.dll,#1
  2⤵
  PID:628