dbfdf8e451c3dabf8be991f38284e114cc208432b6cce1ff2a132fff129e29c5

Analysis

max time kernel
131s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:04

Target

nfapi.dll
Size

124KB
MD5

04a835251535006c85473a604fba8bdc
SHA1

4bed678d9836e20d1f48792a8f4ba1d41e94f629
SHA256

e99db65a51db72018f0469b6d5096a2d469b790efdeec50a955b8ac4e19f16e8
SHA512

e47c5072fd8b581e8312148ca48490a86d4f51d58e6acef90d3d3de8bca5660d62a1b935357f9307c6f89cc35d1d332b0f42f402abf87a8959d4c29af8e5ee67
SSDEEP

1536:sr+PkxJ8MsJvDT4cOApaeaTJ8lxu5lAdzliDofmcpoBzAwI6U/VIWpVDSUt/aup:sr+5MstDTHOApXTZmBIF/aWpVDDtSu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1668 wrote to memory of 4984	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 4984	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 4984	1668	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nfapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nfapi.dll,#1
2⤵
PID:4984