cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb

Analysis

max time kernel
26s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:54

Target

cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb.dll
Size

6KB
MD5

f7b1c9681a3afc2c6f9356ef1aa65bb0
SHA1

f5ae5e5cb0bcd1155cd47ffd1ea784f3a6e31e09
SHA256

cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb
SHA512

17820e05f255d7be4017170e2379aa06840de0f1baefac3f3db98ed4a755468f0a0d0b8aecc2eea35f1306d26d33fd8e458de086bccc7841cafd83903fc9bd36
SSDEEP

96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7ds3qw:juLJ/oAdQPQa2aeng7dsx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1772	604	rundll32.exe	28
PID 604 wrote to memory of 1772	604	rundll32.exe	28
PID 604 wrote to memory of 1772	604	rundll32.exe	28
PID 604 wrote to memory of 1772	604	rundll32.exe	28
PID 604 wrote to memory of 1772	604	rundll32.exe	28
PID 604 wrote to memory of 1772	604	rundll32.exe	28
PID 604 wrote to memory of 1772	604	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb.dll,#1
  2⤵
  PID:1772

memory/1772-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download