8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 11:05

Target

misc/libxml_plugin.dll
Size

997KB
MD5

26f64ab36df64107732968ec1da79f90
SHA1

0a1ae4a9c6f1b5dbc29a03f32020124745331f78
SHA256

b48062c4ca5a2c9d8a1b9148fd049143f09a56f9e8443fc71fb055c015c8edb3
SHA512

b81a549fdb17e7a0f66f9b3884714beca37a5dcf68869b0220c533586d74c4ce6b636e96dac13ee11297609bae5502473b6891b8168ffba5c82e05a1be319022
SSDEEP

24576:Gni4qtpBcbenFjd3TypWE38c2VcRHKBCc3Fy3v/0+tp6Q2yPBJ1:8i4iBcbqFj5TypZOv53gv9BD1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2520	2280	rundll32.exe	28
PID 2280 wrote to memory of 2520	2280	rundll32.exe	28
PID 2280 wrote to memory of 2520	2280	rundll32.exe	28
PID 2280 wrote to memory of 2520	2280	rundll32.exe	28
PID 2280 wrote to memory of 2520	2280	rundll32.exe	28
PID 2280 wrote to memory of 2520	2280	rundll32.exe	28
PID 2280 wrote to memory of 2520	2280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\libxml_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\libxml_plugin.dll,#1
  2⤵
  PID:2520