cbf261dd2bb8bc50e994e7ba74714f048c46e117afd421fe79f4268f1e90bbce

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:01

Target

cbf261dd2bb8bc50e994e7ba74714f048c46e117afd421fe79f4268f1e90bbce.dll
Size

7KB
MD5

a36896062da8dd8e0c484b2b08beaccd
SHA1

dd95031a5fd0660f2e22ac46b86f84e1dfc650bc
SHA256

cbf261dd2bb8bc50e994e7ba74714f048c46e117afd421fe79f4268f1e90bbce
SHA512

40b6e56345fadd8a30cec938bc617691ae07f182d6287f3a6459714ebd5b264809ffd26278e36ca1ab48d67d58cedcd327cb469fb388d760f768897e0aa427bb
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWhbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPzq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1848	2936	rundll32.exe	84
PID 2936 wrote to memory of 1848	2936	rundll32.exe	84
PID 2936 wrote to memory of 1848	2936	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbf261dd2bb8bc50e994e7ba74714f048c46e117afd421fe79f4268f1e90bbce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbf261dd2bb8bc50e994e7ba74714f048c46e117afd421fe79f4268f1e90bbce.dll,#1
  2⤵
  PID:1848