cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b

Analysis

max time kernel
118s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 08:48

Target

cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll
Size

67KB
MD5

4d16e05a1726a88d4fa54a1498d23c68
SHA1

d989db975b869d08850fed582476f8316a3c1993
SHA256

cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b
SHA512

25a3a38744581e726e805abe54bcd95556a583dc8273f71d7168089ac07c0d7a144c96d569e2fdc4231e66bb62a9db8aaa34dc20420e70888ce2bf0b1b8d8838
SSDEEP

1536:bJT7qciEXnB49tbFop8od8JW1wFlqn3XsvEfUZykuI8sfkoHL+Ji6jW6:bh+ciEXBPvJml1MMZykXlfhH4i6jW6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4708	4172	rundll32.exe	44
PID 4172 wrote to memory of 4708	4172	rundll32.exe	44
PID 4172 wrote to memory of 4708	4172	rundll32.exe	44

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9de7cc7e6cbf83fc4f768543ace57b91cac682c99a602b357c29576719b20b.dll,#1
  2⤵
  PID:4708