7411c9840d6323a40eee89d2b52dedd12b13486b955d6e84d6221ea312b3ae80

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 08:35

Target

download-stbl-win(V(us))/mod/bin/jpeg.dll
Size

142KB
MD5

4294d39cc9e5f23754d41b9dde710112
SHA1

1baa1e136f18108ab4e31ec005dec54fc3f23a7c
SHA256

de3eeded01b35dc7c29b0b758211bb1db73ccffb9298d281daf56924ed9e93cb
SHA512

e88dff129dd35445b32a2dbcab97cf752e9acdf82ff88b184fa6d3b461d55bd2d195794802c5ba5e7effa086dc89e0c2cef0c8b0bfa29ac70b75cfb1b4b0584c
SSDEEP

3072:S2yRKm4/j/dKLnjHy7OMD+MqS1RYio7+oD33GnUV0fem2M:S2ytqlYnjHehDzqiq+oD33OUV8Vx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3064	3060	rundll32.exe	28
PID 3060 wrote to memory of 3064	3060	rundll32.exe	28
PID 3060 wrote to memory of 3064	3060	rundll32.exe	28
PID 3060 wrote to memory of 3064	3060	rundll32.exe	28
PID 3060 wrote to memory of 3064	3060	rundll32.exe	28
PID 3060 wrote to memory of 3064	3060	rundll32.exe	28
PID 3060 wrote to memory of 3064	3060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jpeg.dll,#1
  2⤵
  PID:3064