5cbcd31af59f06493e5d4ed8e209e4cdf4606ad09922d51e6ab063b861e152e8

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:39

Target

5cbcd31af59f06493e5d4ed8e209e4cdf4606ad09922d51e6ab063b861e152e8.dll
Size

29KB
MD5

08df16729d25b8de2774793c809296f0
SHA1

3f2147cf290b0c704b1969c909c99983e6df3c0b
SHA256

5cbcd31af59f06493e5d4ed8e209e4cdf4606ad09922d51e6ab063b861e152e8
SHA512

9b3c8c49d8bf8c806b99371a084f9f0b1b037f878e0a75ff2e7e37647db630cd5e9764c939af22f02a43281868e73b1edffc5ea9fed63e53273550ee2e57c482
SSDEEP

768:0BaLxv5KPsZuHof2RrMGB1Wh0NAQh2hHz32zzsMASZcLU:CaCPo+WSnwhT36ASaU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1344	860	rundll32.exe	27
PID 860 wrote to memory of 1344	860	rundll32.exe	27
PID 860 wrote to memory of 1344	860	rundll32.exe	27
PID 860 wrote to memory of 1344	860	rundll32.exe	27
PID 860 wrote to memory of 1344	860	rundll32.exe	27
PID 860 wrote to memory of 1344	860	rundll32.exe	27
PID 860 wrote to memory of 1344	860	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cbcd31af59f06493e5d4ed8e209e4cdf4606ad09922d51e6ab063b861e152e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5cbcd31af59f06493e5d4ed8e209e4cdf4606ad09922d51e6ab063b861e152e8.dll,#1
  2⤵
  PID:1344

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download