cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104

Analysis

max time kernel
39s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:51

Target

cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll
Size

920KB
MD5

97973a2895585289a9b8016ec2da7a80
SHA1

a7b92f277e2191dd87feb32ff070eed590b073c9
SHA256

cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104
SHA512

51b9dfb7c856e3dc332ef96478a02e68f7d214d9222516a8673c5365271ee0315794bbdbde34611dbfbcf3fc6138c488cda52ec8f523d8e8d60d9d1dd835e097
SSDEEP

12288:DFN2OEmVTCCrfei0ENkX5v4XpaO6AeAcAR2TT+yn:DFN2ODVWCbaE8QXEO6AeATR2vTn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 952	1476	rundll32.exe	28
PID 1476 wrote to memory of 952	1476	rundll32.exe	28
PID 1476 wrote to memory of 952	1476	rundll32.exe	28
PID 1476 wrote to memory of 952	1476	rundll32.exe	28
PID 1476 wrote to memory of 952	1476	rundll32.exe	28
PID 1476 wrote to memory of 952	1476	rundll32.exe	28
PID 1476 wrote to memory of 952	1476	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cabc6356eb82a7bff8bcf73175a24058a878f41e60b5ca4c7152d427487d3104.dll,#1
  2⤵
  PID:952

memory/952-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download