cf338fbcdc2e0c182c2bfde643dfe724890a0e0f1014d07064a99653474bbf21

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22/09/2023, 18:50

Target

cf338fbcdc2e0c182c2bfde643dfe724890a0e0f1014d07064a99653474bbf21.dll
Size

64KB
MD5

7152fd93bad10e042f947062233ea543
SHA1

8922845091b881f2af64af14a64a2868c2147203
SHA256

cf338fbcdc2e0c182c2bfde643dfe724890a0e0f1014d07064a99653474bbf21
SHA512

c9fa0021450a3257bc37e7d942d2b491eafad2e86889387a95c6f98505e187cdebee136e1947eccc339302bb896592ff312210ed50289a59ecf304415a711679
SSDEEP

768:3O0svHRao4G4yNsA4XVn6OB8MsVHP0w3zQdQJ5Y1pZJi6kwFOBez2oAMC6Hh4:3OT/cCL4XF6HNDrY1pZnFOBptMC6H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1980	2384	rundll32.exe	28
PID 2384 wrote to memory of 1980	2384	rundll32.exe	28
PID 2384 wrote to memory of 1980	2384	rundll32.exe	28
PID 2384 wrote to memory of 1980	2384	rundll32.exe	28
PID 2384 wrote to memory of 1980	2384	rundll32.exe	28
PID 2384 wrote to memory of 1980	2384	rundll32.exe	28
PID 2384 wrote to memory of 1980	2384	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf338fbcdc2e0c182c2bfde643dfe724890a0e0f1014d07064a99653474bbf21.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf338fbcdc2e0c182c2bfde643dfe724890a0e0f1014d07064a99653474bbf21.dll,#1
  2⤵
  PID:1980