cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b

Analysis

max time kernel
29s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 02:24

Target

cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b.dll
Size

9KB
MD5

64d99e9d8a2585eadfe669b011914f0a
SHA1

e252b4f51d7f2b782cbc2a61abad04e4c5017039
SHA256

cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b
SHA512

6d2ba20400ad995aec477823848e15c93c01d3c16106301154f3b9102f76a6d8ace6a2504fe04a0330d79b1b6c8918ef6a423ad73674226699896603dcdd877c
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:kuwEt8rsTUtPLzKNWSYWF4b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1296	1752	rundll32.exe	28
PID 1752 wrote to memory of 1296	1752	rundll32.exe	28
PID 1752 wrote to memory of 1296	1752	rundll32.exe	28
PID 1752 wrote to memory of 1296	1752	rundll32.exe	28
PID 1752 wrote to memory of 1296	1752	rundll32.exe	28
PID 1752 wrote to memory of 1296	1752	rundll32.exe	28
PID 1752 wrote to memory of 1296	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b.dll,#1
  2⤵
  PID:1296

memory/1296-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1296-56-0x0000000000161000-0x0000000000163000-memory.dmp

Filesize
8KB

Download