cb4346a1f2e47fcef6ec6aa938b50c4b5ac38372335f79a504565acb6b96638b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 20:30

Target

cb4346a1f2e47fcef6ec6aa938b50c4b5ac38372335f79a504565acb6b96638b.dll
Size

94KB
MD5

af26311e227632be91c72dd9c928ce0a
SHA1

387d0e18ac662269ba3f91785e8c643f2f448b47
SHA256

cb4346a1f2e47fcef6ec6aa938b50c4b5ac38372335f79a504565acb6b96638b
SHA512

c3b7c6d4d5a8a47ce7b070e1c3e757caeda38bdf9b901167f79025490f1e21dff9a29639466e40a3d0b32e5cd6528cda67eee05906494de21b9eed75b49b7fd3
SSDEEP

1536:1FXMdOMGKQgNlfQ+VY96t5I9aYib+n9JH4CZ7/Yj4r7XpOfydj1:WJQgNxQ+VYAjrYibGH5Z7Wuuydj1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb4346a1f2e47fcef6ec6aa938b50c4b5ac38372335f79a504565acb6b96638b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb4346a1f2e47fcef6ec6aa938b50c4b5ac38372335f79a504565acb6b96638b.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download