cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 02:30

Target

cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5.dll
Size

7KB
MD5

816fa0286853362ff71ef8f6d65411eb
SHA1

ef536ecf3bed7b20dea3c59cf21e34ccda292c90
SHA256

cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5
SHA512

30b1dee0a21821f53ea8833d280aba44bc46b9c57cf8b80ca5482f0b427841d5fe80fcd8327090d9bbe851c6bff1f40082a95967586ba1ff9b1e459763793a0b
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWobABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPKq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2836	2196	rundll32.exe	28
PID 2196 wrote to memory of 2836	2196	rundll32.exe	28
PID 2196 wrote to memory of 2836	2196	rundll32.exe	28
PID 2196 wrote to memory of 2836	2196	rundll32.exe	28
PID 2196 wrote to memory of 2836	2196	rundll32.exe	28
PID 2196 wrote to memory of 2836	2196	rundll32.exe	28
PID 2196 wrote to memory of 2836	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5.dll,#1
  2⤵
  PID:2836