cbca9aff20f5cfb64e2fcc08d9af30ed0f95190a2b0b03c1cfb418e59164bdf8

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 21:23

Target

b5b0c9fed3a3fc2fe117d23f44d257d8.dll
Size

72KB
MD5

b5b0c9fed3a3fc2fe117d23f44d257d8
SHA1

ff2d8744ba5fd3aacf792d1ce38eaec4f8bc50fb
SHA256

cbca9aff20f5cfb64e2fcc08d9af30ed0f95190a2b0b03c1cfb418e59164bdf8
SHA512

a471aeec41f6b6a9d034d9c4967a7c04d3d21522f417c07039bd0e94fa98db174bded5fa1305dbcede1d3171a1587e846e9ef9ab916266ad5544984cac20a1e4
SSDEEP

1536:r7yUt/+XHsmcRR7ytFpwrN3qEaUU5WQ6tT8W/73YYpMutw3:PtbfRR7KFpwr8Z56tj73YYpPS3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5b0c9fed3a3fc2fe117d23f44d257d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5b0c9fed3a3fc2fe117d23f44d257d8.dll,#1
  2⤵
  PID:2708