cc3fbfa0fa74fbc726e44e82698122ef072faba171c51b65c769b79b359d6790

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 22:19

Target

$TEMP/MobileCertWin32.dll
Size

525KB
MD5

d30b8502aacf89aa5ab0cf1b24d55f11
SHA1

a7937ae4489aea3f3d19c1c04ad530c91db015f2
SHA256

7a617bc84155a4530bdd5d0a4e66f24d1b72e80b25080ae588ab7eeb56c64266
SHA512

b232cfe89f9e5f78c42dc7f5ea65b2a5767f50cb7f4450de739a110f97fec5e85dfffd33020355f6f2e99776c06f8fad41a700b2969e7d43a1921229ba693e8a
SSDEEP

3072:WlRrEUczk3fsF9Nn3ZknBNAjhKmsy8zP0Kss2GufKNQxJgKWJw+Znoi+pes92pkO:WlRreF/gag6IhQ8lP+pes92qG+wK7IB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2384	2528	rundll32.exe	28
PID 2528 wrote to memory of 2384	2528	rundll32.exe	28
PID 2528 wrote to memory of 2384	2528	rundll32.exe	28
PID 2528 wrote to memory of 2384	2528	rundll32.exe	28
PID 2528 wrote to memory of 2384	2528	rundll32.exe	28
PID 2528 wrote to memory of 2384	2528	rundll32.exe	28
PID 2528 wrote to memory of 2384	2528	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\MobileCertWin32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\MobileCertWin32.dll,#1
  2⤵
  PID:2384

memory/2384-0-0x00000000001D0000-0x00000000001FB000-memory.dmp

Filesize
172KB

Download
memory/2384-1-0x0000000000330000-0x00000000003B2000-memory.dmp

Filesize
520KB

Download