cf4b5407f8996d894bdc84e20b09203f50b26dcea73028160c42839b00ce0311

Analysis

max time kernel
123s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 15:44

Target

cf4b5407f8996d894bdc84e20b09203f50b26dcea73028160c42839b00ce0311.dll
Size

899KB
MD5

432fa32126e36fc3a538045e5feb77c4
SHA1

c119dcb8b0215ae8083437a9d17c7c3ea599512a
SHA256

cf4b5407f8996d894bdc84e20b09203f50b26dcea73028160c42839b00ce0311
SHA512

8ed1cfcb1d517eb1210ad793e456c435d8363367a5da6759ba084af591b8542955ff636e17b1c53eb8172a9ab4b2b54c986eb19b2f320d61f8b195e3e392b87a
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXB:7wqd87VB

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5052	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 5052	4480	rundll32.exe	86
PID 4480 wrote to memory of 5052	4480	rundll32.exe	86
PID 4480 wrote to memory of 5052	4480	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf4b5407f8996d894bdc84e20b09203f50b26dcea73028160c42839b00ce0311.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf4b5407f8996d894bdc84e20b09203f50b26dcea73028160c42839b00ce0311.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5052