8e1dfd0fe2f4be63343c311ece0c39c357bb7341978375661707d1a3bec39046

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
08-12-2023 17:51

Target

Update/1.3.36.152/goopdateres_ca.dll
Size

53KB
MD5

85c247e932c900cd6801ee6b9f5447b2
SHA1

e5109d9f4302dcde77c98268ef4f72aa3955586c
SHA256

6605e6a2ef6962229aff407f089189709217a3148cbe627d65ab8a460a3edea2
SHA512

bc7cfc29b9152b759759d0a12de1b980216e52de7be0c4eb5ff9770f5bf5436b2e871774e590dc2cfcda3bf0d84fe02bfd3ee6a3a3309586f348fc60254e193f
SSDEEP

384:x58u2yrzVu/k4bH9tN8hNyH1Mn8E9VFK4igEKWIYi6ygfSJs4i/8E9VF0Ny+kC:b8u2yrBuVTCaM8EAqdYi6yIAseE+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 796 wrote to memory of 2476	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 2476	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 2476	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 2476	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 2476	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 2476	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 2476	796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Update\1.3.36.152\goopdateres_ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Update\1.3.36.152\goopdateres_ca.dll,#1
2⤵
PID:2476