03db63804f51bdc7c31f8c675b3c915170f0ebbac80ea337d52225cc55c76bf9

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/06/2023, 20:01

Target

Silent Aim/dlls/odbg.dll
Size

68KB
MD5

e2f98add53f0cc15d8d99956c9e5e040
SHA1

a55b6f5f772c2b1536914714da3c9c41ff44d90f
SHA256

bd14ddc79d77c9751c4e6e8b78a692387a5cd7ab7876f695bfac8b93ab2363ef
SHA512

42f7fea598c1edf241198561935a88bee2fa0f2ff2928f43867b94fbeb901aa524783548e00fe204e871dc362a209deaf6156056b1514e94615cc857e2b74fe2
SSDEEP

768:sk36zZodZ3O7j8JV3T86/uVRauxWt8Scs8Og95plDJw+iB93pwhBxvXdmIop45:J6zZm3J9T8DMuxWtwN5+SVopK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1420	928	rundll32.exe	27
PID 928 wrote to memory of 1420	928	rundll32.exe	27
PID 928 wrote to memory of 1420	928	rundll32.exe	27
PID 928 wrote to memory of 1420	928	rundll32.exe	27
PID 928 wrote to memory of 1420	928	rundll32.exe	27
PID 928 wrote to memory of 1420	928	rundll32.exe	27
PID 928 wrote to memory of 1420	928	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Silent Aim\dlls\odbg.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Silent Aim\dlls\odbg.dll",#1
  2⤵
  PID:1420