cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 23:08

Target

cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191.dll
Size

48KB
MD5

33f3bacf24d3282e5e79bb07a19bb190
SHA1

840b2068a13821be0793c922264124b934d5c252
SHA256

cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191
SHA512

1ecb63e10600700d6a57a4d1f8062ff74e98e3bc04e342962a6a37028bcc5f58c2e9030eebee3bafb42a67c125a3dbb2f0d81c82ba9d49da2a873f79aa560a5e
SSDEEP

768:k839qG4RjGubnP1LaIXR+J8HWUXIs4IX2IB6zz7SjvSyaMXo9zVP:kFG4RSubnP19R+JkXIwXtAzz7Sjvl1of

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191.dll,#1
  2⤵
  PID:1344

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-56-0x0000000000C50000-0x0000000000D26000-memory.dmp

Filesize
856KB

Download