c5f1dfbf8d4b1d8d5c43f668292056d5b670fea174e6e79d3cc2ba341d66a21f

Analysis

max time kernel
19s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 03:32

Target

data/sonymvd2pro_xp.dll
Size

644KB
MD5

edcc650363a574b3234f58cfe9a5214b
SHA1

546284a43b9303d8710b51afdd7d54b0f3102ee1
SHA256

f91b6ebad0775ef3ae8d541918b3c1fe9f97c3e2fa233b181c0df442ff68ae83
SHA512

0186c7f63053bdb9993bac6ce2f6a503142ef446f638461532226a62a85ded07de63fa40be151173e67918ffa213d6648393cfa342b3a0dc81ba8ebaa6b3c72c
SSDEEP

12288:XwOBX8qR1cW74G+EWC5o21KiQFsxQ8dmTC0pgRij2CrhuTWw7EH4Mk44I9KDBi1d:XtBX8qR1cW74G+EWC5o21KiQFsxQ8gr3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1944	1964	rundll32.exe	28
PID 1964 wrote to memory of 1944	1964	rundll32.exe	28
PID 1964 wrote to memory of 1944	1964	rundll32.exe	28
PID 1964 wrote to memory of 1944	1964	rundll32.exe	28
PID 1964 wrote to memory of 1944	1964	rundll32.exe	28
PID 1964 wrote to memory of 1944	1964	rundll32.exe	28
PID 1964 wrote to memory of 1944	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\sonymvd2pro_xp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\sonymvd2pro_xp.dll,#1
  2⤵
  PID:1944

memory/1944-55-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download