cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 20:00

Target

cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab.dll
Size

160KB
MD5

467669bbf7787608b1757af239020a87
SHA1

ac57e01e911896e42c1314d41bde5863eb74f7d2
SHA256

cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab
SHA512

fd8ec2c06a39947ff4fb87335674d70b0ee95fc9b31ee06802362b3c07501c023d14a3b76524d329a45ff0a5b0c04cacecef35d61f3f3b7493368c6c3231da20
SSDEEP

3072:ETYc2ldltF9jWW808wEptrTsDWUWbWBNLmNTqAXGCeSGgq/JLnXcqJt8A43IT:ETYc2ldltF9jWW84WNk9mNTrXGwGgqSy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28
PID 1112 wrote to memory of 1472	1112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab.dll,#1
  2⤵
  PID:1472

memory/1472-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download