03db63804f51bdc7c31f8c675b3c915170f0ebbac80ea337d52225cc55c76bf9

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/06/2023, 20:01

Target

Silent Aim/dlls/dbg.dll
Size

68KB
MD5

99b5e21dfa5e26e9e1ebbbd7a44a6a66
SHA1

87812a6f2aeafeac828bed5cb05b1a842c48803a
SHA256

8564b2f4c76aac5eb645514bd8fb82a1f57009557c506c0fcef3ce5b2ee078cf
SHA512

3b8bfbac7cf32778e146cb51f9d215fa02f21e848c0669a9abe181a4383e10d6c85e5b73d86791ac8736a0d246dfb2f79f9c04e2a0a1eaba029d34f0ca75b9b6
SSDEEP

768:sk36zZodZ3O7j8JV3T86/uVRauxWt8Scs8Og95plDJw+iB93pwhBxvXdmIoZ45:J6zZm3J9T8DMuxWtwN5+SVoZK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1236	856	rundll32.exe	28
PID 856 wrote to memory of 1236	856	rundll32.exe	28
PID 856 wrote to memory of 1236	856	rundll32.exe	28
PID 856 wrote to memory of 1236	856	rundll32.exe	28
PID 856 wrote to memory of 1236	856	rundll32.exe	28
PID 856 wrote to memory of 1236	856	rundll32.exe	28
PID 856 wrote to memory of 1236	856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Silent Aim\dlls\dbg.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Silent Aim\dlls\dbg.dll",#1
  2⤵
  PID:1236