8e1dfd0fe2f4be63343c311ece0c39c357bb7341978375661707d1a3bec39046

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
08-12-2023 17:51

Target

Update/1.3.36.152/goopdateres_cs.dll
Size

52KB
MD5

5a855172a5d9600e96a8f95319c34e56
SHA1

48d198db7526b067adf94536f6bf9a58c81b3469
SHA256

ba0c71cb9828e6e164878f584aeb028ffc4841ca9243f033793048e42ab42e24
SHA512

b083d601a2776cf683853aad587717eef914801e28cc81a71cbaf5eaeb296161621f09a5598d7481b3c5b661b1418af3c3d9523c4280b6498b4148977765b957
SSDEEP

384:dcSIBWDqBkwEAufRtN8hNyH1Mn8E9VFK4ik9ZIYi6yL/mWVT4i/8E9VF0NyKpuo:GSfjfCaM8EArYi6yrmWZeE0H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2936 wrote to memory of 2992	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2992	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2992	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2992	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2992	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2992	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 2992	2936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Update\1.3.36.152\goopdateres_cs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Update\1.3.36.152\goopdateres_cs.dll,#1
  2⤵
  PID:2992