cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb

Analysis

max time kernel
89s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:54

Target

cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb.dll
Size

6KB
MD5

f7b1c9681a3afc2c6f9356ef1aa65bb0
SHA1

f5ae5e5cb0bcd1155cd47ffd1ea784f3a6e31e09
SHA256

cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb
SHA512

17820e05f255d7be4017170e2379aa06840de0f1baefac3f3db98ed4a755468f0a0d0b8aecc2eea35f1306d26d33fd8e458de086bccc7841cafd83903fc9bd36
SSDEEP

96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7ds3qw:juLJ/oAdQPQa2aeng7dsx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 4300	1716	rundll32.exe	84
PID 1716 wrote to memory of 4300	1716	rundll32.exe	84
PID 1716 wrote to memory of 4300	1716	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb01499e451e4e9a33375d615546fd0257a45da6c73f5c2f822dace3c7823edb.dll,#1
  2⤵
  PID:4300