dc9a325c1cc8008144cc45808a941d50c8b87bc5bceb5c34a26c827404f1a1e3

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 01:15

Target

GS_LOADER/data.dll
Size

2.4MB
MD5

49dec65e16ecf52ba6d65d1359209381
SHA1

237dacbc6570d9c9b4d919dfdbe9901bf515cc63
SHA256

9ac097492073df0282e9161f61f794b1c06688b95be60d96f6233cbf8122e427
SHA512

74e411215a44ba728bdb917501cbd1beb5e3bc2bd673f2a2912bcb6ceca48e41b8eb7ab9ecc11a85cf4f10ddc9605a77612cebf8aa4cd3679ffc7a0e14b100b3
SSDEEP

49152:YCKmqan4No+mhH2ntXGbxbl3Uh/54rXmm3DRYiTKFxU2xsSOxO3RWFQ/4s:NR4cMMxZw54aqDOiesHcRa24s

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1724	1148	rundll32.exe	28
PID 1148 wrote to memory of 1724	1148	rundll32.exe	28
PID 1148 wrote to memory of 1724	1148	rundll32.exe	28
PID 1148 wrote to memory of 1724	1148	rundll32.exe	28
PID 1148 wrote to memory of 1724	1148	rundll32.exe	28
PID 1148 wrote to memory of 1724	1148	rundll32.exe	28
PID 1148 wrote to memory of 1724	1148	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GS_LOADER\data.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GS_LOADER\data.dll,#1
  2⤵
  PID:1724

memory/1724-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download