cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62

Analysis

max time kernel
294s
max time network
383s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:54

Target

cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62.dll
Size

220KB
MD5

eefa7049a4866ef8b511018dfa1662b0
SHA1

0d219d706f7cd052c550a1d81b6b87737030a6a9
SHA256

cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62
SHA512

7bf048cc6fc25848ff90a67a42cb06700f214f5f37c82cf2d055683bce18bb7ced9ca8d5e7f9727dd1caa9d34c10112991bb34e87e95d2e4a5883d83553fec07
SSDEEP

3072:o+VUJvJQHwCxiaHsR1bNis+lne2S6M5nMxuS2pNPNvJtC9070bMXfnNfsO5PF:oJJhRyH+bN2S6S072p5NvJuU0bQPNfn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3572	5072	rundll32.exe	79
PID 5072 wrote to memory of 3572	5072	rundll32.exe	79
PID 5072 wrote to memory of 3572	5072	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb3868477164914705935e5d06a3ed1d09318a751225728845c4594025b6bf62.dll,#1
  2⤵
  PID:3572

memory/3572-133-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download