5b69fc1168558573d4b91d91aebeb20a24e2f855e95c5a30da82df23d4ce0699

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:46

Target

supportfiles/customResource0009.dll
Size

2.0MB
MD5

1c1fef8c9588bcceda2b2a26ac974afc
SHA1

0582a5ba59206076e4ebadadd9f2a3838f0044ee
SHA256

ff60c57b959bcd3cb586f8be508dde2712ef7b896c2a56bffaa544fde7286c1e
SHA512

2603e7833f8070c4e19397cc12aeb50808f2655417303a62b66bb63cc526c0203bdc750d128ed3682302fe4a83bfbbc29c140734ad902f235ae2261d9ddaedc5
SSDEEP

3072:gIXatRRGEPVA8Oxp0he0npsMv1gcORJUB+0nJUhr:gIcq8Oxp0he0nyMKcORJUB+0ny

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3012	2208	rundll32.exe	28
PID 2208 wrote to memory of 3012	2208	rundll32.exe	28
PID 2208 wrote to memory of 3012	2208	rundll32.exe	28
PID 2208 wrote to memory of 3012	2208	rundll32.exe	28
PID 2208 wrote to memory of 3012	2208	rundll32.exe	28
PID 2208 wrote to memory of 3012	2208	rundll32.exe	28
PID 2208 wrote to memory of 3012	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\supportfiles\customResource0009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\supportfiles\customResource0009.dll,#1
  2⤵
  PID:3012