03db63804f51bdc7c31f8c675b3c915170f0ebbac80ea337d52225cc55c76bf9

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/06/2023, 20:01 UTC

Target

Silent Aim/dlls/vstdlib_s.dll
Size

200KB
MD5

963a90479472342c2e30e0cf0fb0f2e6
SHA1

0803a940989e235879be5149583ae6e918faa456
SHA256

86d1c234c266966d424976b0f81a46495057aa7a791edc16bef5f04238720dc0
SHA512

c2480a3d774f0cc302f05f46ba33d38250ab90731e02b915ce6919da67c61e4537f78494ae2c4b5be9c872433eabc9f7a58a39b1bb23ca078c95cc8e48dfcd36
SSDEEP

3072:S5hEf99KYgIc+0xbGZ8a5DBg6eWGMB5YPS79O+lclwS/rTH:JXKdGZ8a5DyBCaPS79O61K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1296	924	rundll32.exe	27
PID 924 wrote to memory of 1296	924	rundll32.exe	27
PID 924 wrote to memory of 1296	924	rundll32.exe	27
PID 924 wrote to memory of 1296	924	rundll32.exe	27
PID 924 wrote to memory of 1296	924	rundll32.exe	27
PID 924 wrote to memory of 1296	924	rundll32.exe	27
PID 924 wrote to memory of 1296	924	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Silent Aim\dlls\vstdlib_s.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Silent Aim\dlls\vstdlib_s.dll",#1
  2⤵
  PID:1296