7f84b9d1710249e6194cf77d1bd58cdb0eef49ff1e502bbea5a586f5c2b9aa70

Analysis

max time kernel
1338s
max time network
1170s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
10-07-2024 15:40

Target

libcef.dll
Size

172.1MB
MD5

967dec6091ac3d9711a4d42b44e7f94d
SHA1

851f45fba8a521ef6e18db08449f100cdfe0e12c
SHA256

d0c2d48f10d7333d3ef27a88c75925d2ba2ccdfa3776a2167d7b2d6b764d44f1
SHA512

3c3da14c0cd22522efd6f068fe0c03de7e57cc3737050d1c396b162deedc037807769dd41959d3a8f79886c23f92759cfe035b220855ee6c4ea2c59c9b80b9dc
SSDEEP

1572864:0ZtQpYZYIf6OlbFndcIQ6/zYhWaQJ2k75nfI7Pmx1knbsHap/mKAh6pVwThrBRcc:0Ziw/kvwO9WDq4Icv2tZFVvwbnyQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3604	1524	rundll32.exe	78
PID 1524 wrote to memory of 3604	1524	rundll32.exe	78
PID 1524 wrote to memory of 3604	1524	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcef.dll,#1
  2⤵
  PID:3604