cb939a1c8691afbd5ace61e009f5c00bc52f6feea8c16e8a5ad5d153258e54e3

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 11:56

Target

cb939a1c8691afbd5ace61e009f5c00bc52f6feea8c16e8a5ad5d153258e54e3.dll
Size

2.0MB
MD5

819f8726fde942862afb706206e7626b
SHA1

f304c3192d4edbfe012d8280e8aa739050210ee3
SHA256

cb939a1c8691afbd5ace61e009f5c00bc52f6feea8c16e8a5ad5d153258e54e3
SHA512

59ef169bfed795f72c9a4bdb8d64a889e24e7360850eabdd2b86f004e774e8493b690b4266614ac87b8b189eb2a62fba0c65f58f184344b34216a9075aeadf73
SSDEEP

49152:Dgb3IT9QZt0M5VjuzKFXcrrF9ROevzhPE:DgMEX2KFXqi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1264	3892	rundll32.exe	82
PID 3892 wrote to memory of 1264	3892	rundll32.exe	82
PID 3892 wrote to memory of 1264	3892	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb939a1c8691afbd5ace61e009f5c00bc52f6feea8c16e8a5ad5d153258e54e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb939a1c8691afbd5ace61e009f5c00bc52f6feea8c16e8a5ad5d153258e54e3.dll,#1
  2⤵
  PID:1264