cdbeb517caf371ee103a3986ae245c351e10a9cb448acd7769622060a3b4931d

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 23:25

Target

cdbeb517caf371ee103a3986ae245c351e10a9cb448acd7769622060a3b4931d.dll
Size

5KB
MD5

867915598f0a4121e0002fc4178f9650
SHA1

bb57142e830a72ca412dc8e4d33647cc36b01114
SHA256

cdbeb517caf371ee103a3986ae245c351e10a9cb448acd7769622060a3b4931d
SHA512

02731c422be7a86acb404d6f8dee422ec425fc91413fa2bf625ef414b9059639706758f60b82813f35dd43a948f5426197e44a00045b8fc2fa0a9c0c42afb405
SSDEEP

48:qfAVqmtqcRH9rhWR0OCxPWE7+PIExjhahIPsNp6hju5jOr0W09xD5cvR:FtrRdrY0x7+PZftCMR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdbeb517caf371ee103a3986ae245c351e10a9cb448acd7769622060a3b4931d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdbeb517caf371ee103a3986ae245c351e10a9cb448acd7769622060a3b4931d.dll,#1
  2⤵
  PID:280

memory/280-54-0x0000000000000000-mapping.dmp

Download
memory/280-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download