def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:18

Target

Thunder/ComDlls/BrowserHelp/ThunderComponent.dll
Size

77KB
MD5

79f3f971689b83163104e3e7835346da
SHA1

98a4f2396db6b6e28c561cee34e6b75b8aa43545
SHA256

e02fcbdc1d31fe3582668512c0447907cd0eaa63c37ef6ff8965ce5fb63aaefc
SHA512

444b9f70408e963619e0b807bcb2e0cb9d999ea290a81f1689d095a47b8b2a32d3b31c84a07a20408ef6b85453a5867283261a05dd77c297fa2299fd7451b655
SSDEEP

1536:4xt/Dsh84WlR64+O4vN7UPRhAElAG8KlACy8SqM:QshwU4+O4NUPRWElAMlA98JM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\BrowserHelp\ThunderComponent.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\BrowserHelp\ThunderComponent.dll,#1
  2⤵
  PID:1728