21b7a83fc28da70c4fef177801c33ff5d31deb50015311453bf7e6dce0b484a1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 15:07

Target

cbb922c6215997aad0c43addcd93154b.dll
Size

158KB
MD5

cbb922c6215997aad0c43addcd93154b
SHA1

8448dcc6f37238fae72eab0d60732cf481339080
SHA256

21b7a83fc28da70c4fef177801c33ff5d31deb50015311453bf7e6dce0b484a1
SHA512

ec71f799b98a1f860ca46158e65cf1dff6d17125c12fa28e628fef3e530dae2ef40e1f37c7ac71b3b82367bd94295e984ca75c723ec244d703e86e9541d22516
SSDEEP

3072:vVNkgRmU8/DpfJU5OjZj4w8TU1uv5IIIPMpEtAEZYLKrV1oiyy:9NYU8L6OR8TUov5NpEqEZYLKJS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbb922c6215997aad0c43addcd93154b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbb922c6215997aad0c43addcd93154b.dll,#1
  2⤵
  PID:3028