cb24bbbaa62c824d589249c54ed699f1c2160701579d51284158e57300e64922

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 16:35

Target

cb24bbbaa62c824d589249c54ed699f1c2160701579d51284158e57300e64922.dll
Size

2.2MB
MD5

d8384e09ac3786ec2f6fdac02c8b6b62
SHA1

453757684bb2d61a83fb4e512de5560cbc36208e
SHA256

cb24bbbaa62c824d589249c54ed699f1c2160701579d51284158e57300e64922
SHA512

22ddc2fc9179fc5522a805eaa8686c21fceabe69db4065e1b1ac7c96580a3d2632078a430b638343235e78dc1657251745910fcb342f23f2871890ea06c5a839
SSDEEP

49152:TJd0OM5Fym/8RgJuYM97tQjFSzL19wNa/WgX:VCOM56yJ7jFkp9JWgX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2188	2884	rundll32.exe	28
PID 2884 wrote to memory of 2188	2884	rundll32.exe	28
PID 2884 wrote to memory of 2188	2884	rundll32.exe	28
PID 2884 wrote to memory of 2188	2884	rundll32.exe	28
PID 2884 wrote to memory of 2188	2884	rundll32.exe	28
PID 2884 wrote to memory of 2188	2884	rundll32.exe	28
PID 2884 wrote to memory of 2188	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb24bbbaa62c824d589249c54ed699f1c2160701579d51284158e57300e64922.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb24bbbaa62c824d589249c54ed699f1c2160701579d51284158e57300e64922.dll,#1
  2⤵
  PID:2188