cbda0d92db8802f39a4c6b3f7b54774303bf0580ed5d68da4afb2e97c762b5a6

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 04:17

Target

cbda0d92db8802f39a4c6b3f7b54774303bf0580ed5d68da4afb2e97c762b5a6.dll
Size

50KB
MD5

4d110f3b8c3fa98711abe8ede2fe2647
SHA1

cdd37ee9cded0b76d9b0ece0e459d1f88541d3c1
SHA256

cbda0d92db8802f39a4c6b3f7b54774303bf0580ed5d68da4afb2e97c762b5a6
SHA512

1d46a43627b6a64a80d9694f6edefced7c19f678d62dd4a2dd5acae1b2b6ae6b9e15024a5b93ad453086075d1881ce79dc6192ca1bc2c044eba71512bc50307b
SSDEEP

768:n2W5cWMGXUJOrxEtuOFzOQyd11fTHhoO07yVNq5a9Puj5HtdmvOwfuJU9yH+uvK:2ndGXpcfo51hoZyogsHtdmWwNoi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbda0d92db8802f39a4c6b3f7b54774303bf0580ed5d68da4afb2e97c762b5a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbda0d92db8802f39a4c6b3f7b54774303bf0580ed5d68da4afb2e97c762b5a6.dll,#1
  2⤵
  PID:912

memory/912-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download