cbd33d7ba3b8ef4562c696e1b70b5e71faded4cfb6b18b5f4c3d2eae20abf872

Analysis

max time kernel
133s
max time network
139s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26/04/2024, 14:21

Target

NetflixCE V4/NetflixCE/ced3d9hook.dll
Size

124KB
MD5

5f1a333671bf167730ed5f70c2c18008
SHA1

c8233bbc6178ba646252c6566789b82a3296cab5
SHA256

fd2a2b4fe4504c56347c35f24d566cc0510e81706175395d0a2ba26a013c4daf
SHA512

6986d93e680b3776eb5700143fc35d60ca9dbbdf83498f8731c673f9fd77c8699a24a4849db2a273aa991b8289e4d6c3142bbde77e11f2faf603df43e8fea105
SSDEEP

1536:yq8Iw0TnMfrUEuKo+w/lT35oBqhSw3kmuqW3Crf0d3N1NsCeOEy6jCMpOEsC:yq8IdTMTyXUR2JJry3NreOnMpOu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4312	3708	rundll32.exe	72
PID 3708 wrote to memory of 4312	3708	rundll32.exe	72
PID 3708 wrote to memory of 4312	3708	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\ced3d9hook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\ced3d9hook.dll",#1
  2⤵
  PID:4312