8e1006e5f230f269bb9ce80e5c2b7f3b930cb68f3d975697d45b4e4bae33ce58

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:16

Target

getword/TextCapture/GetWordNT.dll
Size

128KB
MD5

8770a5e0d05fb51879ca8b14673e7588
SHA1

d1632d1256e5e1a52137d569d9af40f09b2dc796
SHA256

96ac3ce2b0c7f26a8e745b1d54286eda5dcbf57523543a5bfff44df8c2d3e41b
SHA512

2e8251bbccb667345ba4d0275da7b5f3fa7f817943aa998eb7d4c750f7070ff4cc900bfefdfcc409c1be94def5dd69cf83e4ec6a28f434459794e6108ab7b6e7
SSDEEP

1536:EmaSfDN7zm/xo/NL9B5TdXA14SYsCWgB1kgC4e3SbckYb55B6Zo:vN7Sy/Z3A4WgdC4ISbckO55BOo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28
PID 2912 wrote to memory of 2932	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\getword\TextCapture\GetWordNT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\getword\TextCapture\GetWordNT.dll,#1
  2⤵
  PID:2932