469a9542e6ead679fea6d069d766d49cfbff752e6d8415e6bfb276f9bf129b54

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 06:34

Target

cab8d83e8b1820ab3c18cac89dc0f75e.dll
Size

8KB
MD5

cab8d83e8b1820ab3c18cac89dc0f75e
SHA1

bca1c41c102fb6712cf5883c78dabe9e209c6a5c
SHA256

469a9542e6ead679fea6d069d766d49cfbff752e6d8415e6bfb276f9bf129b54
SHA512

62052701161391736f72fb5f7b0a02587e38d6602f76db24b21d98b9932c341c652086f9d2b584f2873f5ef6cf79d4ec2b0d88bc9f905c36d5b285a52dbd9a2e
SSDEEP

192:JhpxJ8rBlddxpeDxvejhd9yezaSWvnScNWYrzEXZ3Cax8X/KAVkgUw9+:JhbJ8rJdQSTz8nScNWYMlCaxpA6h

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1348	2244	rundll32.exe	28
PID 2244 wrote to memory of 1348	2244	rundll32.exe	28
PID 2244 wrote to memory of 1348	2244	rundll32.exe	28
PID 2244 wrote to memory of 1348	2244	rundll32.exe	28
PID 2244 wrote to memory of 1348	2244	rundll32.exe	28
PID 2244 wrote to memory of 1348	2244	rundll32.exe	28
PID 2244 wrote to memory of 1348	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cab8d83e8b1820ab3c18cac89dc0f75e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cab8d83e8b1820ab3c18cac89dc0f75e.dll,#1
  2⤵
  PID:1348

memory/1348-0-0x0000000025000000-0x0000000025037000-memory.dmp

Filesize
220KB

Download