cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 08:48

Target

cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll
Size

67KB
MD5

4d16e05a1726a88d4fa54a1498d23c68
SHA1

d989db975b869d08850fed582476f8316a3c1993
SHA256

cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b
SHA512

25a3a38744581e726e805abe54bcd95556a583dc8273f71d7168089ac07c0d7a144c96d569e2fdc4231e66bb62a9db8aaa34dc20420e70888ce2bf0b1b8d8838
SSDEEP

1536:bJT7qciEXnB49tbFop8od8JW1wFlqn3XsvEfUZykuI8sfkoHL+Ji6jW6:bh+ciEXBPvJml1MMZykXlfhH4i6jW6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll,#1
  2⤵
  PID:1728

memory/1728-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download