4d5176d1854b96b6f6fcaeb04a2bfee8881db88f67638c58b5473011d357fe41

Analysis

max time kernel
128s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 18:15

Target

plugins/stealth.dll
Size

33KB
MD5

1e8148c0ed59d81879b067d580980f61
SHA1

281b6e0bf1e794323410178d7a0f8f48c2c44059
SHA256

242d4a0ca869a650a41bf4be0e7a84001ccd3f85a5ac35c8445ae9d45754f845
SHA512

c38dccdbf4d183278d607ff703dab6ddd46cff3520947a682df309db3afe5fe6afceaca904faa0a70173667f6408c521fa90f84828fd463846a53608313ac57f
SSDEEP

768:YC/+lDa6D0fYeSnpOz4PQA0yKH40SkSno4xoha5F:tSDFnpDQCO4Az

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 336 wrote to memory of 1932	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1932	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1932	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1932	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1932	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1932	336	rundll32.exe	rundll32.exe
PID 336 wrote to memory of 1932	336	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\stealth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\stealth.dll,#1
2⤵
PID:1932

memory/1932-54-0x0000000000160000-0x0000000000179000-memory.dmp

Filesize
100KB

Download
memory/1932-55-0x0000000000160000-0x0000000000179000-memory.dmp

Filesize
100KB

Download
memory/1932-56-0x0000000000160000-0x0000000000179000-memory.dmp

Filesize
100KB

Download
memory/1932-57-0x00000000001C0000-0x00000000001D9000-memory.dmp

Filesize
100KB

Download
memory/1932-58-0x0000000000160000-0x0000000000179000-memory.dmp

Filesize
100KB

Download
memory/1932-59-0x0000000000160000-0x0000000000179000-memory.dmp

Filesize
100KB

Download