f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6

Resubmissions

23/06/2026, 21:26

23/06/2026, 18:19

user interaction
yes
max time kernel
298s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 21:26

Target
pf.dll
Size 1.2MB
Sample260623-1afeeagv7s
SHA256 f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6
MD5 5ef7bf4ed52be2a6d5ebbcf3076fba5f
SHA1 9e03e983e26d4782a3fef0a6ebb47fdcd46974c9
SHA512 66d80b3505d3fce7f4b4f238affb000423b429ee75aa5cd757e0fb810d31d54e593a58bc019de7abc440ae9d4fbc60ca33f33a85ed9a4783e721e844dd263a37
SSDEEP 12288:bLL0VMmPPvq6NXRTp7A2jsb3yDbe7qDu6ZPIFqYUrIcOR5XQRd+V2z3hrAduEYR+:3KNPPTXRTK2+GmFMIcqQqVg3hrrFHRO
TLSH
T1A9459F16739802B9E17BE17DC9974A46E6B278054330E7CF03E496AA2F277E14A7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5568 wrote to memory of 3568	5568	cmd.exe	93
PID 5568 wrote to memory of 2904	5568	cmd.exe	94
PID 5568 wrote to memory of 3420	5568	cmd.exe	95
PID 5568 wrote to memory of 4612	5568	cmd.exe	96
PID 5568 wrote to memory of 1248	5568	cmd.exe	97
PID 5568 wrote to memory of 1856	5568	cmd.exe	98
PID 5568 wrote to memory of 5980	5568	cmd.exe	99
PID 5568 wrote to memory of 2176	5568	cmd.exe	100
PID 5568 wrote to memory of 6024	5568	cmd.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pf.dll,#1
1⤵
PID:5016

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dll,1
  2⤵
  PID:3568
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dll,1
  2⤵
  PID:2904
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dll
  2⤵
  PID:3420
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dll,1
  2⤵
  PID:4612
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dll
  2⤵
  PID:1248
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dl.#1
  2⤵
  PID:1856
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dll.#1
  2⤵
  PID:5980
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dll,#1
  2⤵
  PID:2176
- C:\Windows\system32\rundll32.exe
  rundll32 pf.dll,1
  2⤵
  PID:6024