bdf68e5e5c96f4ca8cac0354c4e79974a5afe47165058372f91b3c5660f0478f

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:36

Target

LaunchManager_Dritek_7.0.4_W8x64/IdCardHelp.dll
Size

207KB
MD5

b9b3f5ccca8c9da272f7b4946edf5d94
SHA1

7399e0b89a50f22aa8a6545c6c6681aa135b049e
SHA256

ef6148cbfb0ada156b442b7cea2ee15484f89f39690ee9dd3d26a05624b83c47
SHA512

d7addbb5dd98d8ea34c23e843ce69bbfd02f8816cd2c002d025e4fbd97a03d6efd8d59aa4ca42fd7307a4eedbc6ca93cc50c6c8483bfa2b6742575c46d48afd7
SSDEEP

3072:KKcuB3ayUTDeZb4EdCNVLWSrCt3KB4wWhUZlPWf/zVGKCI:KVuB3ayLbXUNUt3EH2ZGI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2748	2452	rundll32.exe	28
PID 2452 wrote to memory of 2748	2452	rundll32.exe	28
PID 2452 wrote to memory of 2748	2452	rundll32.exe	28
PID 2452 wrote to memory of 2748	2452	rundll32.exe	28
PID 2452 wrote to memory of 2748	2452	rundll32.exe	28
PID 2452 wrote to memory of 2748	2452	rundll32.exe	28
PID 2452 wrote to memory of 2748	2452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LaunchManager_Dritek_7.0.4_W8x64\IdCardHelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LaunchManager_Dritek_7.0.4_W8x64\IdCardHelp.dll,#1
  2⤵
  PID:2748