cb5adbdb1234d36d9e62b7f5298d4dcef589a2f7c08944681192746b83ac81dc

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:54

Target

cb5adbdb1234d36d9e62b7f5298d4dcef589a2f7c08944681192746b83ac81dc.dll
Size

360KB
MD5

09cb65d821a2893d6e8d4af5b49cc046
SHA1

416c9793146570ec182e0a1e9c335ac17a2f524f
SHA256

cb5adbdb1234d36d9e62b7f5298d4dcef589a2f7c08944681192746b83ac81dc
SHA512

b3bb2edf2987619ea820b4acc9223e3cc7e32970e58c9d334d612eeb3b9bc2489a6f7a7578ac73483f267b9e46f36b44933d2ee02aa6025bdf99f4b71d851234
SSDEEP

6144:mqlMQjnSgRwYCAE1ZvtD+k6rGgBiXg5RZLLNtViqpymJZBKCP0ryKF6yiF:mronSgR9CXvtD+k6rDgQ5nUqpymfkT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1140 wrote to memory of 1016	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 1016	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 1016	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 1016	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 1016	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 1016	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 1016	1140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb5adbdb1234d36d9e62b7f5298d4dcef589a2f7c08944681192746b83ac81dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb5adbdb1234d36d9e62b7f5298d4dcef589a2f7c08944681192746b83ac81dc.dll,#1
2⤵
PID:1016

memory/1016-54-0x0000000000000000-mapping.dmp

Download
memory/1016-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1016-56-0x0000000073F10000-0x0000000073F6D000-memory.dmp

Filesize
372KB

Download
memory/1016-57-0x0000000073F11000-0x0000000073F66000-memory.dmp

Filesize
340KB

Download