8e1dfd0fe2f4be63343c311ece0c39c357bb7341978375661707d1a3bec39046

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
08-12-2023 17:51

Target

Update/1.3.36.152/goopdateres_bg.dll
Size

53KB
MD5

de51ee7d6abf67cb175defb18778e4ad
SHA1

2c830c982b8c3be515bc49a5cf9a7d4e2683e6f9
SHA256

f1aa2f7f925f43b6fd5d8fd434d245bdaf4782ba0250f5b4a3b5fef6151ffc4f
SHA512

e112a3e49d7c44430f1e4c04322a4a75888773c9bc609447565ba8043c8b981003d95a4228baf14fbe3f90a63bfef0d218628750e517f892ff45df7550efaf63
SSDEEP

384:AQF/pQtck8aGIZBOc/tN8hNyH1Mn8E9VFK4iZFL7l9IYi6y8424i/8E9VF0NyHn3:1FhQl7DFCaM8EAxlqYi6yz2eEp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2376 wrote to memory of 2692	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2692	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2692	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2692	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2692	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2692	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2692	2376	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Update\1.3.36.152\goopdateres_bg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Update\1.3.36.152\goopdateres_bg.dll,#1
  2⤵
  PID:2692