6ecff9d04bda4d4149f1a78486ede32e15a36b9d94fce5509467b3af1feede01

Analysis

max time kernel
34s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/12/2022, 17:16

Target

VirtualBox-7.0.2-154219-Win/Focus.dll
Size

69KB
MD5

b2dc28e6f5c1a009e170ee757edfbbde
SHA1

eeb434c436f90d34f8afc5bbb2aed274c1fcab85
SHA256

a8c85834569b0e6415279ace2b081cd4ddecd0b5251f97ad9ee552b95b3eb913
SHA512

36d681b08a5c590f7f55433354a479dbeff7277ee629f129a9594bd3914dda793103138b68c27abb55a3935b9670d08e944dd42fa014b40d6201aa3160df706b
SSDEEP

1536:1BatzfxEtW3kG6T9ylchO/rbgtZeoGh6Kyjwji3hkj:jE0DT9ylchO/rEtK3EiNj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1580	2012	rundll32.exe	28
PID 2012 wrote to memory of 1580	2012	rundll32.exe	28
PID 2012 wrote to memory of 1580	2012	rundll32.exe	28
PID 2012 wrote to memory of 1580	2012	rundll32.exe	28
PID 2012 wrote to memory of 1580	2012	rundll32.exe	28
PID 2012 wrote to memory of 1580	2012	rundll32.exe	28
PID 2012 wrote to memory of 1580	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.2-154219-Win\Focus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.2-154219-Win\Focus.dll,#1
  2⤵
  PID:1580

memory/1580-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download