cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62

Analysis

max time kernel
57s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:54

Target

cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62.dll
Size

220KB
MD5

eefa7049a4866ef8b511018dfa1662b0
SHA1

0d219d706f7cd052c550a1d81b6b87737030a6a9
SHA256

cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62
SHA512

7bf048cc6fc25848ff90a67a42cb06700f214f5f37c82cf2d055683bce18bb7ced9ca8d5e7f9727dd1caa9d34c10112991bb34e87e95d2e4a5883d83553fec07
SSDEEP

3072:o+VUJvJQHwCxiaHsR1bNis+lne2S6M5nMxuS2pNPNvJtC9070bMXfnNfsO5PF:oJJhRyH+bN2S6S072p5NvJuU0bQPNfn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 900	520	rundll32.exe	28
PID 520 wrote to memory of 900	520	rundll32.exe	28
PID 520 wrote to memory of 900	520	rundll32.exe	28
PID 520 wrote to memory of 900	520	rundll32.exe	28
PID 520 wrote to memory of 900	520	rundll32.exe	28
PID 520 wrote to memory of 900	520	rundll32.exe	28
PID 520 wrote to memory of 900	520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62.dll,#1
  2⤵
  PID:900

memory/900-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/900-57-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download