7ee8f22c98aa12fd857957b213a700b35b3b57522e17d0b584455d08d7cdca4c

Analysis

max time kernel
34s
max time network
57s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/09/2022, 10:17

Target

Lumion 12 Pro/donut/libEGL.dll
Size

208KB
MD5

8a2b8adcac38aebaf2db2f7ac9d48739
SHA1

6b167aa777e3cdceab18c04edc7a64afe58a6152
SHA256

fbed115e8c32a137bbdffffa73d5e5ceb5c82441079c6afe471cd94821c7499e
SHA512

dda6f436ec80d5d993a01f73484034f85fc918ac8707989e01eb53c7c13b1c29678e8165d470524de1dafb0c8fd1523d723b3190f89c5f6e35405ea193db3e34
SSDEEP

3072:BXYFqtvMBOpw+py7arltg9hhKJErP+vsAg0FuUJF/AAg0Fuq157R/iNA:BXYSvMBbl7Ufg9hhKJuosAOUTAAOSsA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 1756	988	rundll32.exe	27
PID 988 wrote to memory of 1756	988	rundll32.exe	27
PID 988 wrote to memory of 1756	988	rundll32.exe	27
PID 988 wrote to memory of 1756	988	rundll32.exe	27
PID 988 wrote to memory of 1756	988	rundll32.exe	27
PID 988 wrote to memory of 1756	988	rundll32.exe	27
PID 988 wrote to memory of 1756	988	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lumion 12 Pro\donut\libEGL.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lumion 12 Pro\donut\libEGL.dll",#1
  2⤵
  PID:1756

memory/1756-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download