d8f54575aff075268200250b3ed4af1da894db2199432b7110605003c6afba4a

Resubmissions

07-02-2024 13:21

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-02-2024 13:21

Target

220509 - (Cabinet Meeting 2022)/libcef.dll
Size

190KB
MD5

268d61837aa248c1d49a973612a129ce
SHA1

1da0d7053ace976847cc2c9ff783743195178013
SHA256

966ab1c468e3fc7d8d8b2d73a9ca9a85d352a0db8043c5eab36dd304a5915812
SHA512

ec9015ffb5d7f5b545ce30f91314de961757c1f885ef3a66a7b918418f48cfbe38dcfa9d2ac9c8969469560d50696a55c8a9d5b55f58f675e1248b7328ccbcaa
SSDEEP

3072:GZyxSazBuliXpfiRFc/E4RqaHH+h2hsD1ZeTir6l9ZsyBtPUb:Gn4pKrcZqWH+hGsfeTZL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1632	2628	rundll32.exe	28
PID 2628 wrote to memory of 1632	2628	rundll32.exe	28
PID 2628 wrote to memory of 1632	2628	rundll32.exe	28
PID 2628 wrote to memory of 1632	2628	rundll32.exe	28
PID 2628 wrote to memory of 1632	2628	rundll32.exe	28
PID 2628 wrote to memory of 1632	2628	rundll32.exe	28
PID 2628 wrote to memory of 1632	2628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\220509 - (Cabinet Meeting 2022)\libcef.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\220509 - (Cabinet Meeting 2022)\libcef.dll",#1
  2⤵
  PID:1632