cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5

Analysis

max time kernel
54s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 02:30

Target

cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5.dll
Size

7KB
MD5

816fa0286853362ff71ef8f6d65411eb
SHA1

ef536ecf3bed7b20dea3c59cf21e34ccda292c90
SHA256

cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5
SHA512

30b1dee0a21821f53ea8833d280aba44bc46b9c57cf8b80ca5482f0b427841d5fe80fcd8327090d9bbe851c6bff1f40082a95967586ba1ff9b1e459763793a0b
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWobABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPKq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5244 wrote to memory of 5188	5244	rundll32.exe	84
PID 5244 wrote to memory of 5188	5244	rundll32.exe	84
PID 5244 wrote to memory of 5188	5244	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfca9d1b755c3910b6e1828ed27447143028b0d1bc9453835d63a6a5098d39f5.dll,#1
  2⤵
  PID:5188