7411c9840d6323a40eee89d2b52dedd12b13486b955d6e84d6221ea312b3ae80

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 08:35

Target

download-stbl-win(V(us))/mod/bin/jp2native.dll
Size

18KB
MD5

4023e25f92b5f13e792901bf112a8ea2
SHA1

31adcd411905832b89ea55dec8b9c83af3c7d3ea
SHA256

432aedac59fa161fed5a5d95ca5f8cfd1d73a35abe8a7090d137100f727b687b
SHA512

ad0e6f8071eb09e843989e637baca988dd7706d84fc26db7c2e18bbe03a78a6c5bfe4f1b28289b5929b2b86c53fb6c3dae42523dc8ede8057a8f431aea77bb20
SSDEEP

384:PTjlu57T5J5eFeYW7TPVlN3B+ASZQ4NNR7F3qnYPLr7om0:PnUd5eFeDfd5Sj7oC7om0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 820	2344	rundll32.exe	28
PID 2344 wrote to memory of 820	2344	rundll32.exe	28
PID 2344 wrote to memory of 820	2344	rundll32.exe	28
PID 2344 wrote to memory of 820	2344	rundll32.exe	28
PID 2344 wrote to memory of 820	2344	rundll32.exe	28
PID 2344 wrote to memory of 820	2344	rundll32.exe	28
PID 2344 wrote to memory of 820	2344	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jp2native.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jp2native.dll,#1
  2⤵
  PID:820