ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/02/2023, 16:50

Target

32bit/Plugins/MovieTexture.dll
Size

31KB
MD5

8a7097f411529df0400771bc67d9a09a
SHA1

3623206c14352fe4b2ab0c47fa40480d84d21944
SHA256

62d08d840b6e2c30aa7c09aa0c727c9a81f6c6214cac5ec0b8acc2dc20d76ecb
SHA512

7b7a038cb297bc49dc4f75da5b30b1d5f26436ebe96e802844485f72288f6554915cc949a0f58130fae91a8d37ae0e7f54c2c7dbca0e2b0aa02058e0727316a6
SSDEEP

768:Oc6qH24z602RoGzHtf3Ia8Mxl10I6BVYhzD/qOZoOdro7:56Q24z/uocHl3Ia8Mxl10xbYhzDSOZPo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28
PID 272 wrote to memory of 1728	272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\MovieTexture.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\MovieTexture.dll,#1
  2⤵
  PID:1728

memory/1728-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download