8da6ee120b4c46531a4daa180bb5df3964e817407e941c8cc6aeffbab923ef38

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:48

Target

Serv-U/ServUPerfCount.dll
Size

60KB
MD5

8cf7d383f9b20be9ba8e8ec2bd1518c7
SHA1

1c4b38055d7490cb2fb5e9d09600089bf84cfad5
SHA256

3f1c1eda9df77e5f2439ddecb91357fb43e7911d2d3f6ffc2c70d93b047c33ba
SHA512

4419cc45686d8684bea2f05a57412cb7b3872aeee745dd01345c9dbbe8ff571d0221b5485721eb6fe49fb3e6a1c8dabacab44553b56ee12fb71effd9242811c5
SSDEEP

768:wmlDyMsSL4YK1fzog/iyd1ELWvzTbladUvTt2M1jrlnGTT6U:F0MsSwRzog6qELIzTkKvTX9lGTT6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28
PID 2396 wrote to memory of 2416	2396	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Serv-U\ServUPerfCount.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Serv-U\ServUPerfCount.dll,#1
  2⤵
  PID:2416