68ce8c2149b4eab7e6a8aea2c101b414d9ad64b6f2b6ad2c44ae2a61d36725f8

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/07/2023, 15:28

Target

ikpFlac.dll
Size

156KB
MD5

d9605bc4d631cfd03fdb827d9f3e5763
SHA1

8cd7567fa4231363163d5a1fe1fbfd6abe1fa558
SHA256

09c22d5cec7ec0685fea4a48f5bb64b7243435c5b61e928e053ee0c8e65affcc
SHA512

e7c7628d7d8356b7809a8ce8bf33f37428bc2b78d5aecaa887537ad58664bf2b2306ae4a760b8a8df6d90aaa0f3047a0610b1b37d762a309075677c0072a51fe
SSDEEP

1536:37zPPCCgZnAGYNzsLI/Kfc/42fS6zTkKV2UF2UJvYmdj5v2fh2MQI2t5voMtiDiv:rMJzks8/KfcJkWjj302t5vjti+v

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 620	764	rundll32.exe	28
PID 764 wrote to memory of 620	764	rundll32.exe	28
PID 764 wrote to memory of 620	764	rundll32.exe	28
PID 764 wrote to memory of 620	764	rundll32.exe	28
PID 764 wrote to memory of 620	764	rundll32.exe	28
PID 764 wrote to memory of 620	764	rundll32.exe	28
PID 764 wrote to memory of 620	764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ikpFlac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ikpFlac.dll,#1
  2⤵
  PID:620