06fd4d290117d8601ae557c494e43e6fa2edb48b796d51262aa77a862dbca1f7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 00:39

Target

$PLUGINSDIR/efoaq.dll
Size

120KB
MD5

c642b341e69cd35ca434cb5d046415b7
SHA1

b292770856b5689445a88b58fa2f9a477b4a1231
SHA256

5db3d75eeb1b3f5b2cc28c5ac0c13441f944d0095d212d06afd4aa5548708b9f
SHA512

e873ff5cbb711323560516cb581a7bb756f45828abb4f0c27605b07e98713e92ede29db772adac1fdaba078f48b8202a670b965d088a2b51f967b105d692bc0c
SSDEEP

1536:yhdeTMPViwLdiIuoV/E35+E1mmbfkRNn9RSLMPJFGrnaB3ZoJrMSfU:yaTO4IuwyhbydjJFGc3Z+ISc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1044	2184	rundll32.exe	28
PID 2184 wrote to memory of 1044	2184	rundll32.exe	28
PID 2184 wrote to memory of 1044	2184	rundll32.exe	28
PID 2184 wrote to memory of 1044	2184	rundll32.exe	28
PID 2184 wrote to memory of 1044	2184	rundll32.exe	28
PID 2184 wrote to memory of 1044	2184	rundll32.exe	28
PID 2184 wrote to memory of 1044	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\efoaq.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\efoaq.dll,#1
  2⤵
  PID:1044