5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
142s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:57

Target

nfapi.dll
Size

334KB
MD5

1ac6313643ab8be85e87b53f47e4af79
SHA1

10a9b2d40a18399f0235dcd4872375aef409e6d5
SHA256

d12c75b752322a00d727c9a8305ab60092b33fd26988ca3aa8cf5b7f4b29b8c5
SHA512

9a286cb37462314ab4a04879c1a2e762c04acd5365af5c77897af1294b6deda43fdf5b0c709575fbf6058bc7c9606bd891743fc314cf63e3ecb059ff3175af10
SSDEEP

3072:KKpHwC6H+AYYYxYYYYYrs/NAWOZFvyfaP710WkYsf+6pu6v3tgHf+dNUxJcGtHFZ:KKpHMg61ZFvyfKLkzfrnvGHfDcGtrht

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2480	2420	rundll32.exe	80
PID 2420 wrote to memory of 2480	2420	rundll32.exe	80
PID 2420 wrote to memory of 2480	2420	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nfapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nfapi.dll,#1
  2⤵
  PID:2480