e0fed2784ab6280f6f602be319b4d4d4884778e4bfd1e88e6948a751b8523f60

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-09-2023 07:36

Target

Setup_new/libwinpthread-1.dll
Size

77KB
MD5

1f4411c1f66c9cdf96ca9d7f9caf52d9
SHA1

ea04be653df7335483c7c8f46367d75d4ad9224e
SHA256

b5fe4d6408ef2baabdd168f4c7250900606468e9aeb24c71e0c833d3d715ae65
SHA512

8b95d0533773c5424733862cf60ed0f0d2ed5c7016b602a71dc4ce4a90ef0946de605f46c94fb0f6c3135447f60a00d3476e8b91a61e079885aa764bc1407b8a
SSDEEP

1536:NCogndcxz8C7iYx3AUwTG36Djm2uYUjslAsvONDuJluLjIGxim3Yx:Nydcaix3v363K+GNDDLjIEim3Yx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1456 wrote to memory of 2156	1456	rundll32.exe	28
PID 1456 wrote to memory of 2156	1456	rundll32.exe	28
PID 1456 wrote to memory of 2156	1456	rundll32.exe	28
PID 1456 wrote to memory of 2156	1456	rundll32.exe	28
PID 1456 wrote to memory of 2156	1456	rundll32.exe	28
PID 1456 wrote to memory of 2156	1456	rundll32.exe	28
PID 1456 wrote to memory of 2156	1456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Setup_new\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Setup_new\libwinpthread-1.dll,#1
  2⤵
  PID:2156