cbef947d981de3cd15b8bcead0a36fb9e91d14ce974d49889e6e3ee2db3de9ea

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 02:35

Target

cbef947d981de3cd15b8bcead0a36fb9e91d14ce974d49889e6e3ee2db3de9ea.dll
Size

5KB
MD5

7de81da456ae7ba760361bbe9a23e998
SHA1

cfd836755db9e7233f80fb63d3bd72aa89cab940
SHA256

cbef947d981de3cd15b8bcead0a36fb9e91d14ce974d49889e6e3ee2db3de9ea
SHA512

ab2f6560101accc86efc831c495e0683bb77f2763a5a811a5915e1a744525dc9fe7c10d406076f8322c7036bb7137b4600ad58b3bf2b288a6095dea94082a170
SSDEEP

96:hy859x0P8Mae46lPxj6JeT2/mxDqdljXDlftNt6v:F5oL7s/mxWdljXDllNYv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 3476	3292	rundll32.exe	83
PID 3292 wrote to memory of 3476	3292	rundll32.exe	83
PID 3292 wrote to memory of 3476	3292	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbef947d981de3cd15b8bcead0a36fb9e91d14ce974d49889e6e3ee2db3de9ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbef947d981de3cd15b8bcead0a36fb9e91d14ce974d49889e6e3ee2db3de9ea.dll,#1
  2⤵
  PID:3476