ccd1435a4f112cd6b28dd4351622db674c7dca64e3e7875bb1db36f3763e35ed

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-04-2023 19:52

Target

Plugins/32bit/ConfigActive.dll
Size

86KB
MD5

e3ace6bdf16c8cc05eacac71dab76210
SHA1

137c0c903429ef27ea2f819ba7246e1636c20e07
SHA256

e7667e2f5808da5b8640bb5a9c1195b3f704c09a2e4445acaaa3ab149da2e2a2
SHA512

43d12c76c62e21b958ecde76524baa6176c1e7e03f815a04782dc623836bc9a719550a5b350b255c04fea548528a28514ee39273409d1b5351ab6975a24c25d6
SSDEEP

1536:pgGCgcsWo6cdpy9kBwAcXrEhuhAEJV8QnCFqiYDHLYfwQRuLA5sH94z/L:pgG7tbpy9lVInFqiYjEKLA5sH94z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1584	1640	rundll32.exe	28
PID 1640 wrote to memory of 1584	1640	rundll32.exe	28
PID 1640 wrote to memory of 1584	1640	rundll32.exe	28
PID 1640 wrote to memory of 1584	1640	rundll32.exe	28
PID 1640 wrote to memory of 1584	1640	rundll32.exe	28
PID 1640 wrote to memory of 1584	1640	rundll32.exe	28
PID 1640 wrote to memory of 1584	1640	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\32bit\ConfigActive.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\32bit\ConfigActive.dll,#1
  2⤵
  PID:1584