cb5aa4e532e70ee859ebb76b70d8c9f95e4c4121c717aaa08beedc8ec4e411c0

Analysis

max time kernel
40s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:38

Target

cb5aa4e532e70ee859ebb76b70d8c9f95e4c4121c717aaa08beedc8ec4e411c0.dll
Size

7KB
MD5

3ee0728df858e4b99e057391d96a06f0
SHA1

03f381a8904314c3fb712a23e84d818aa93ade84
SHA256

cb5aa4e532e70ee859ebb76b70d8c9f95e4c4121c717aaa08beedc8ec4e411c0
SHA512

d170bf468a8bc0ed56599f55a74d1bde273b44462e981d157431c081498c0a2b7f0e54ef0b1aaae5475f1b0df87f143b845417d4829212a92dbc2cfde6909483
SSDEEP

96:DixZjmjtjd8jPjcZGR5TI65jc5+PwU9230aMFym1ynrsvQOvZvom2YXApU6:unSR6bgYX5QA4UA30aQ+nYr2YX8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 576	1664	rundll32.exe	28
PID 1664 wrote to memory of 576	1664	rundll32.exe	28
PID 1664 wrote to memory of 576	1664	rundll32.exe	28
PID 1664 wrote to memory of 576	1664	rundll32.exe	28
PID 1664 wrote to memory of 576	1664	rundll32.exe	28
PID 1664 wrote to memory of 576	1664	rundll32.exe	28
PID 1664 wrote to memory of 576	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb5aa4e532e70ee859ebb76b70d8c9f95e4c4121c717aaa08beedc8ec4e411c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb5aa4e532e70ee859ebb76b70d8c9f95e4c4121c717aaa08beedc8ec4e411c0.dll,#1
  2⤵
  PID:576

memory/576-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download