6ecff9d04bda4d4149f1a78486ede32e15a36b9d94fce5509467b3af1feede01

Analysis

max time kernel
83s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15/12/2022, 17:16

Target

VirtualBox-7.0.2-154219-Win/cbutton.dll
Size

1.6MB
MD5

cb661895c58709fcc87ff2fcb92f7785
SHA1

fd142aef7d7c0c68d78047bcb14e8b2fec07d976
SHA256

d57a11a1f209a516a074e23a0c4510ba7dceda282400b98fc447d5698bea8963
SHA512

74c37a84183cc63182fa9f3e6e30e425afb5b7ad07fc3a73330e60b32ff5f56d0c6a74f4bd53c28fd1e55a851c4a8ca2d805972a9d667af2055f232b406b9f00
SSDEEP

24576:qHvkq0/jEZFD+RAQV24KTxW9FL2itGfnWut6x6PIk0QxjBEN4+TGgIBNnD:GO67/Wut6x6PIsqhTG1BND

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2188	2864	rundll32.exe	81
PID 2864 wrote to memory of 2188	2864	rundll32.exe	81
PID 2864 wrote to memory of 2188	2864	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.2-154219-Win\cbutton.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.2-154219-Win\cbutton.dll,#1
  2⤵
  PID:2188