5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 14:05

Target

portable/wx._windows_.dll
Size

797KB
MD5

98566a15d4d5a95c7490e5b0fe11fb43
SHA1

e0f2b0dc93396e6616b09b391c4658d0bb6a5a58
SHA256

c21d6096a7aaa0ec8bf39ebe97c8e365e57b24717a13ba88e8e42f5625257549
SHA512

dad5566d6252a344eba654b001b3349bda7759a93a7515e8ed55e47b8c88ddfe65198ef139b63c669b419e15ffea9bc6ee0ac5f899542e84166b24c09c2db6ff
SSDEEP

6144:5GSP3XepvKqY3nwyTQQD8PDzXQ2ysSDY3TmFGZ1SmakETALtPu9B4yT0kuTpQV7L:5BvXe0qY3nwyTQQD8PPFiUanpKCGG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1156	1072	rundll32.exe	27
PID 1072 wrote to memory of 1156	1072	rundll32.exe	27
PID 1072 wrote to memory of 1156	1072	rundll32.exe	27
PID 1072 wrote to memory of 1156	1072	rundll32.exe	27
PID 1072 wrote to memory of 1156	1072	rundll32.exe	27
PID 1072 wrote to memory of 1156	1072	rundll32.exe	27
PID 1072 wrote to memory of 1156	1072	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._windows_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._windows_.dll,#1
  2⤵
  PID:1156

memory/1156-54-0x0000000001EE0000-0x00000000020D7000-memory.dmp

Filesize
2.0MB

Download