cdbbbc9591e1818bdb23eb630212ee553107ace9ab6d42a340f4cc7608303eb5

Analysis

max time kernel
9s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:56

Target

cdbbbc9591e1818bdb23eb630212ee553107ace9ab6d42a340f4cc7608303eb5.dll
Size

11KB
MD5

79ce95df704616cbd047763da03e0453
SHA1

5d23f9381f3a1ef8af7b0060d34a392b7b4f45aa
SHA256

cdbbbc9591e1818bdb23eb630212ee553107ace9ab6d42a340f4cc7608303eb5
SHA512

55406fd75f68c8f762cb9ec8c902169e225e97461e910e0a1193df884551e628af878ca05ad40f02136e51692433a3f6d6255e8bd4cbb1f71488a4ac3ed76e60
SSDEEP

192:AqDTt3f7VBohrx6gDgmfDpQY5Imr53AnKpM0d+Tgj/gdGIONkV:AYTlirxZDgm7SYxGnKS0d+Tgj/gdGB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2020 wrote to memory of 692	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 692	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 692	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 692	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 692	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 692	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 692	2020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdbbbc9591e1818bdb23eb630212ee553107ace9ab6d42a340f4cc7608303eb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdbbbc9591e1818bdb23eb630212ee553107ace9ab6d42a340f4cc7608303eb5.dll,#1
2⤵
PID:692

memory/692-54-0x0000000000000000-mapping.dmp

Download
memory/692-55-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/692-56-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download