5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0

Analysis

max time kernel
25s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-04-2023 14:05

Target

portable/wx._gdi_.dll
Size

787KB
MD5

092ff91d310da2e7ba61d31f1c2cd29e
SHA1

0e244348d2722deee8acd2c9cdb6c561ce475f45
SHA256

568e2431880c3aa223962da2e71b6e2b771cc6bfd2190e555eeb107350a0cdb9
SHA512

24bdde91782b5cbe341b3a301cdb61bad2a3cb8cec44e2ed5af9e6681fe2b948540dd2d4860d628e3b6f54d1517bac92ff0eab2c97afdee199c56e5f914da64d
SSDEEP

12288:kK9HzhHKvHwpUdp7mm2k/ok/Oyciy4RuAeCMrQVE1SDWJNl+WmMi:jVdKvHwpUdp739tuAeCMrQyWWJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28
PID 1204 wrote to memory of 1264	1204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._gdi_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._gdi_.dll,#1
  2⤵
  PID:1264

memory/1264-54-0x00000000009E0000-0x0000000000BD7000-memory.dmp

Filesize
2.0MB

Download