8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a

Analysis

max time kernel
118s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 11:05

Target

misc/libgnutls_plugin.dll
Size

2.0MB
MD5

68c2b5c132fe5aacf675ec8f6df41f89
SHA1

0650d5f5bb86e43af87b9115a1c648c0c891f36b
SHA256

2405bc0ab114c134cd60e404ce54e8dbcd12d0e046ca916f82c005386b5dadee
SHA512

23698c52cbf56f093a485b73bda63229f2e1a1665df3bd3f4bc0f4644d5f6b39ce1cdfa6229292fb5f545d0c4df1937396ac7ab989e82ac82dcf78f49d42f965
SSDEEP

49152:K3H7PNsFYLF69K296zvLxhJupQzu85BZ8T/Lgx5BvCidMAxMF:YH7iFYLcYrrEQzuEBD5BvCtF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2320	2800	rundll32.exe	29
PID 2800 wrote to memory of 2320	2800	rundll32.exe	29
PID 2800 wrote to memory of 2320	2800	rundll32.exe	29
PID 2800 wrote to memory of 2320	2800	rundll32.exe	29
PID 2800 wrote to memory of 2320	2800	rundll32.exe	29
PID 2800 wrote to memory of 2320	2800	rundll32.exe	29
PID 2800 wrote to memory of 2320	2800	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\libgnutls_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\libgnutls_plugin.dll,#1
  2⤵
  PID:2320