1007c86086853e273164a3a16e282c2e0ba55984d4c9925e821fdc5c19fad12c

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
16-11-2023 09:44

Target

2/LxBase.dll
Size

948KB
MD5

d743a6bf808f7b33b070c6658429d745
SHA1

d5e8113b256b00eae11d1afa4c832347b4fdaf49
SHA256

0ca96517035953824ad51fa970172c6c51879ddb132b9e37da097f3687ad7796
SHA512

2bf65ef698731c489d927472cf9743a7a84a9e857bc979d01af8963d967e99c17b4c38aa1cf01e24a18e92a1a99dcdf6513f0821a41b541c05831997d0f432b2
SSDEEP

12288:3dqYAmmsHpYYiz1uZdFxM/mDd88tduImUum7Ix+btPQLMkxalHhROzea2nU:3rDmsHpYYizIZy/mDPHuIVZooPOwqgU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2608 wrote to memory of 2828	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2828	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2828	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2828	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2828	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2828	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2828	2608	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2\LxBase.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2\LxBase.dll,#1
2⤵
PID:2828