ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4

Analysis

max time kernel
29s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-02-2023 16:50

Target

32bit/Plugins/Texture.dll
Size

147KB
MD5

839d6af2056e6cb65ccb14c7f3642a26
SHA1

6ba919328b51d5e46a8438372071a2c787499e44
SHA256

f9c9b98af1a4f49afd4040e73897a6237c4c61ecab73e73f10ee2928ca984c00
SHA512

e68fcc66de7582c7c800ce8038babdba91ea8a10dac19c521e05cb808dea482a7aac32cf455ac1a249d9680ba7ad210cbe88692db0dbd7508b10d34b8cea4892
SSDEEP

3072:lVy7kDvqEVhnEFx5Z736ogilJDlZThj2UGp14QH+FSOZEa:l5qEVhEFxH7zjlFPJ2/1eFSOZEa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\Texture.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\Texture.dll,#1
  2⤵
  PID:1708

memory/1708-54-0x0000000000000000-mapping.dmp

Download
memory/1708-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download