9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 02:57

Target

todolist_exe/CalendarExt.dll
Size

348KB
MD5

dfb8429cf20d2f6e2eeaebf37796772e
SHA1

820f013adfc076d4808165cef883dd1dcc7d57c0
SHA256

1605a9dd198299c80c38c3a03fe126b88dd6fa8078334bc4841d9f7bc689264f
SHA512

66ce863956c1dd70823a5807881fe8844bcc7bfdec158b11ef65436c8aacc77cfa9ce58ea154ee27081c9ba6161c97928aa9624865f53dc2b772a5b2740285cf
SSDEEP

6144:EF1TIOatBZ2dauLXheRaExU9h54drKw9cF4ai8FOaru+8x8NR:/ltRMhaaEyh54ZEi8Fh9Zf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2156	2796	rundll32.exe	27
PID 2796 wrote to memory of 2156	2796	rundll32.exe	27
PID 2796 wrote to memory of 2156	2796	rundll32.exe	27
PID 2796 wrote to memory of 2156	2796	rundll32.exe	27
PID 2796 wrote to memory of 2156	2796	rundll32.exe	27
PID 2796 wrote to memory of 2156	2796	rundll32.exe	27
PID 2796 wrote to memory of 2156	2796	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\CalendarExt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\CalendarExt.dll,#1
  2⤵
  PID:2156