cb38fc75549b574d3020eb129f61e4cc1b7ce2920ee54b44b4441c828f7442e1

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:04

Target

cb38fc75549b574d3020eb129f61e4cc1b7ce2920ee54b44b4441c828f7442e1.dll
Size

57KB
MD5

c3e1694d847824fa72a8f23c9cad6440
SHA1

85859bc0a393748ad470026657d37c7b9766e647
SHA256

cb38fc75549b574d3020eb129f61e4cc1b7ce2920ee54b44b4441c828f7442e1
SHA512

5d3f0e543259a06ced0b9494262bd2536217010ad5f756dd8f6aa32be5f1d4d6e6c0f714f91d46eb7e859b4b0ccb9a91492a8fbf8250346aa740f0066b8b43d8
SSDEEP

1536:GNIKD94YU6EMyDcqiZZZNihyISFIR6/JP+3CT:Hq94YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28
PID 1996 wrote to memory of 1364	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb38fc75549b574d3020eb129f61e4cc1b7ce2920ee54b44b4441c828f7442e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb38fc75549b574d3020eb129f61e4cc1b7ce2920ee54b44b4441c828f7442e1.dll,#1
  2⤵
  PID:1364

memory/1364-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download