f40fdc94d6692812e7ad056d5c5b5a7c212baa7abff156ed1de0b2a3bf17f2dc

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 07:15

Target

Miranda IM/Plugins/Aim.dll
Size

182KB
MD5

cb94a104e253a89739d09d3d001f9dbe
SHA1

45a30d0302574179ef13ee6d12e9c816c03ba4c0
SHA256

95f22f1b602aeebc582cd3860d546f143766d6d92130a00bb9624d1ac976a3ee
SHA512

3d80164cb2ce076be141ce71cb255d86568c36850729ce9409ebbfbbfd001c2d9074d26de0e0e090c6427c89e9a77bd89f223579026cefc0d63de4600f6516a3
SSDEEP

3072:3Mh0fqO5U7aIMf+ID1VXLZERyBay/23J9uJuI+LjnT0SmaD99DcabCL8b0L045fh:5UGI3IeRyBe9DlbW5fh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2388	1696	rundll32.exe	28
PID 1696 wrote to memory of 2388	1696	rundll32.exe	28
PID 1696 wrote to memory of 2388	1696	rundll32.exe	28
PID 1696 wrote to memory of 2388	1696	rundll32.exe	28
PID 1696 wrote to memory of 2388	1696	rundll32.exe	28
PID 1696 wrote to memory of 2388	1696	rundll32.exe	28
PID 1696 wrote to memory of 2388	1696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\Aim.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\Aim.dll",#1
  2⤵
  PID:2388