d325349f9f0e077c4de6ad96f903009876e4e1b222e19993e761808149e4939a

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 14:09

Target

FlFramework.FlExceptionManagement_JC.dll
Size

41KB
MD5

20ec2c4a66f0fe7f3ee5b8360679e6e4
SHA1

c5388254eb8c71fa1b442422eb35ba0d05a19bc4
SHA256

d325349f9f0e077c4de6ad96f903009876e4e1b222e19993e761808149e4939a
SHA512

2c2e6c63533cbaab3d40e1eb70f105a1a98fed077f7165576c47cfd874aba161e8c42fa95fc017af8074c6ef4fba2608a16c1d7c6ac494b5fa23ae7852fe51f9
SSDEEP

768:qaJQNBFa5BvkWdlEYVsZ3jBCQ5dOVJRiLwbjDQ6/JN:qRBc5Bv7dfsZ3jBld58d

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1312	2164	rundll32.exe	28
PID 2164 wrote to memory of 1312	2164	rundll32.exe	28
PID 2164 wrote to memory of 1312	2164	rundll32.exe	28
PID 2164 wrote to memory of 1312	2164	rundll32.exe	28
PID 2164 wrote to memory of 1312	2164	rundll32.exe	28
PID 2164 wrote to memory of 1312	2164	rundll32.exe	28
PID 2164 wrote to memory of 1312	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FlFramework.FlExceptionManagement_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FlFramework.FlExceptionManagement_JC.dll,#1
  2⤵
  PID:1312