6a0664da0332aa8f4428914ba6aff37506fd239776a881e6d24f1cf5b60cbb70

Resubmissions

24-09-2023 15:33

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
24-09-2023 15:33

Target

jansson.dll
Size

359KB
MD5

94140e827a0960e4d5b00e04378526d3
SHA1

0ddb9943b4480fc769ebd2357c16dfecad319104
SHA256

3808f179810ccf44d4ad770850f132ddd8978017801a8cb6536c3221d74d6e1c
SHA512

2acef1e4e435c246f13b9001bfdc83c352fa5ec8ad7e12b93d2b81ee13d3a49229d58f74b97b062cb85d0a6c44da05862da4c71ec4be98b63630a9d8be03a088
SSDEEP

6144:AzEldF2RjxSSC2zoT+mWDD4mcSUVtNFqZltWkt4h7ipXDFEYgZ+GFffcD:5GRjxSSC2ETXM4mcSCNQZltW64qgZjM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2172 wrote to memory of 2236	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 2236	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 2236	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 2236	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 2236	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 2236	2172	rundll32.exe	rundll32.exe
PID 2172 wrote to memory of 2236	2172	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jansson.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jansson.dll,#1
2⤵
PID:2236