9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 02:57

Target

todolist_exe/GPExport.dll
Size

128KB
MD5

5c5034609b4912a85250f3a60daa7849
SHA1

e1e0c0c9d8c7c5206a395a0533fd262d0d015f99
SHA256

19245515f64e9ab3a553025f50dfe8393724117fc63baa2d37d1855ad488f206
SHA512

108223cda1e27ddb7f646e55b201cde862e4abb7bf4cf77f4f55b63a56b096cd3ea72e1805783bca19a794e7fe4f18e91ef94ed015c483dc68fdfa7e007c2aba
SSDEEP

1536:DdJmUUjnO8Q7MPtDPTecFqygW6rkvoC88n3otvtzMon9MfhcG2D4hsuQBdwlHyY:DqUUlt0yg2n3U7Iv2DvuQBdwRyY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1948	2084	rundll32.exe	28
PID 2084 wrote to memory of 1948	2084	rundll32.exe	28
PID 2084 wrote to memory of 1948	2084	rundll32.exe	28
PID 2084 wrote to memory of 1948	2084	rundll32.exe	28
PID 2084 wrote to memory of 1948	2084	rundll32.exe	28
PID 2084 wrote to memory of 1948	2084	rundll32.exe	28
PID 2084 wrote to memory of 1948	2084	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\GPExport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\GPExport.dll,#1
  2⤵
  PID:1948