cb95f3594765c794d6439ca2be69de39128e3bc66b3234a3da0fa50d4493b3f6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 02:18

Target

cb95f3594765c794d6439ca2be69de39128e3bc66b3234a3da0fa50d4493b3f6.dll
Size

797KB
MD5

5e1d60aa834bf2d645c373a55c85d84e
SHA1

0af3d546c16577bf4bdccd2cfba97d6b10fea6f0
SHA256

cb95f3594765c794d6439ca2be69de39128e3bc66b3234a3da0fa50d4493b3f6
SHA512

f34cc707b27b985b2bb926c52cc263cd82f2707c95463205d10e493ed51cd2f84fef22b8ef426a53300e3981270fb390c78fbe0707ce00107c220a895b8ae503
SSDEEP

12288:malVLOIzVlbvfVbhi43B/ktkj+QUB8VbMGYQP79:ma/aiVlbvNbc43B/ktkjMBc79

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb95f3594765c794d6439ca2be69de39128e3bc66b3234a3da0fa50d4493b3f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb95f3594765c794d6439ca2be69de39128e3bc66b3234a3da0fa50d4493b3f6.dll,#1
  2⤵
  PID:2808