a148412a5c1cc9aba0ecdbb3e44010aeac75b40f23492bd04c0127e558aa44ac

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 04:31

Target

[email protected]/components/OfferBoxXpCom.dll
Size

94KB
MD5

2e619bbb0c7d078b79be4ea94b8f9c31
SHA1

a72aab4defe54d679c5815e99ca5138f1487671f
SHA256

fa5fa9ee65b61c98d74810d5825ca37ff9e37d8ae50fcbccf0bab42eac0cde12
SHA512

234c7ee91f69db64e6b32913232b9ad4b75f1da64377391444ce5b12fa93b3eec7b977397f6c61acd36cb67e09876ff40105c1ed2bce610308a83dce49448cc3
SSDEEP

1536:9iC0px/QM6k3lFX5zf2R4gV2flkhSJyJmq2fBRI5mb6lpatyCNs:On4pkjQR4fI4qGBi5mOl0tbs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1880	624	rundll32.exe	28
PID 624 wrote to memory of 1880	624	rundll32.exe	28
PID 624 wrote to memory of 1880	624	rundll32.exe	28
PID 624 wrote to memory of 1880	624	rundll32.exe	28
PID 624 wrote to memory of 1880	624	rundll32.exe	28
PID 624 wrote to memory of 1880	624	rundll32.exe	28
PID 624 wrote to memory of 1880	624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\[email protected]\components\OfferBoxXpCom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\[email protected]\components\OfferBoxXpCom.dll,#1
  2⤵
  PID:1880