bdf68e5e5c96f4ca8cac0354c4e79974a5afe47165058372f91b3c5660f0478f

Analysis

max time kernel
120s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:36

Target

LaunchManager_Dritek_7.0.4_W8x64/DHBKcUtl.dll
Size

86KB
MD5

373bbeb9220a40d51880dd63ec5b6a6f
SHA1

4362d422fb38ab9e57d165ca65b600ac5bbf1cbb
SHA256

2443256e769b9814a5c5c7ae58f82d3b6eac5d4756b1516c3bae0ea3a5f39241
SHA512

bbd968a09d3935cde832b6a74b1bd651a8441e3691d4daa1a89ef9705cb7768ba857e62d8b3ffbed43dd9ce78f140f05b2cb239f911b1461c2034e64d8fa7e21
SSDEEP

1536:VwsqVAwcqP1HohXF88g8mIePaKhQ9SXu8CxC8DZ:syyHohXFBm1aKhQ8RWl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3060	2512	rundll32.exe	24
PID 2512 wrote to memory of 3060	2512	rundll32.exe	24
PID 2512 wrote to memory of 3060	2512	rundll32.exe	24
PID 2512 wrote to memory of 3060	2512	rundll32.exe	24
PID 2512 wrote to memory of 3060	2512	rundll32.exe	24
PID 2512 wrote to memory of 3060	2512	rundll32.exe	24
PID 2512 wrote to memory of 3060	2512	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LaunchManager_Dritek_7.0.4_W8x64\DHBKcUtl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LaunchManager_Dritek_7.0.4_W8x64\DHBKcUtl.dll,#1
  2⤵
  PID:3060

memory/3060-0-0x0000000000280000-0x00000000002CF000-memory.dmp

Filesize
316KB

Download