51e03c20365634c61b0262562cff384a9480522e659187f78153cc4c7fce7cca

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 17:42

Target

GD_Hack/ToastedMarshmellow.dll
Size

5.3MB
MD5

32021c61bfaab63473484ebe328e9107
SHA1

3833f1c7ecbfe4e787cfea843cdee9e394d9cf1c
SHA256

16aa73d256d50753964af66a17cefb05dfdfb1ec7b7521933cda26265940db71
SHA512

70cb23d43295b3fedf26d2943aaf1d5204b7a479acc7f3755ccbf68d1c413a749ca9269185b9d39b647efe8cdeced781fe66b96f2a8736b7b57a2d5887be1910
SSDEEP

98304:qvKksv5Q04MIgqbGGwLqRhjWYw35mugMgzEiMfW75TKzVO8pJZ:qvnsR4i8aKugMnyTKOK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3048	2092	rundll32.exe	28
PID 2092 wrote to memory of 3048	2092	rundll32.exe	28
PID 2092 wrote to memory of 3048	2092	rundll32.exe	28
PID 2092 wrote to memory of 3048	2092	rundll32.exe	28
PID 2092 wrote to memory of 3048	2092	rundll32.exe	28
PID 2092 wrote to memory of 3048	2092	rundll32.exe	28
PID 2092 wrote to memory of 3048	2092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GD_Hack\ToastedMarshmellow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GD_Hack\ToastedMarshmellow.dll,#1
  2⤵
  PID:3048