cdb58c7bf8883678e5289d4e15e4859145d5d748536132764e120f503afef6fe

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 05:30

Target

cdb58c7bf8883678e5289d4e15e4859145d5d748536132764e120f503afef6fe.dll
Size

32KB
MD5

6c04486569dddf2777b30650c71d53b0
SHA1

cb4db974135d7551832288b2bc31d4c7a9a858be
SHA256

cdb58c7bf8883678e5289d4e15e4859145d5d748536132764e120f503afef6fe
SHA512

82957d09d09005ba6f2d702739f244bb34dd39ca045e64dd997e5bd0fcd43711e045cda412e7607a57893410ea6958d30e7a1c3e0d087fd0ccf9d0eaf52a8cc4
SSDEEP

768:W2Pr8feR1Geasryxdy7pF6ozhZflIRv1qqm:W2Pr8feCezB7p8gDNIRNqv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27
PID 1604 wrote to memory of 1156	1604	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdb58c7bf8883678e5289d4e15e4859145d5d748536132764e120f503afef6fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdb58c7bf8883678e5289d4e15e4859145d5d748536132764e120f503afef6fe.dll,#1
  2⤵
  PID:1156

memory/1156-54-0x0000000000000000-mapping.dmp

Download
memory/1156-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download