8257389d6264742d414404beaaaac869336c91f9f9af1e31ee081aa6e7857f3c

Resubmissions

19/01/2024, 19:16

19/01/2024, 14:16

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 14:16

Target

lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-gif.dll
Size

41KB
MD5

a762b54e2fedd949efc9f0e73326ed97
SHA1

379d03aab3558b49c53de54eff46b41c4334cba5
SHA256

28d2dc3fe8a66f1937ce722766c8f5416d8b282bb3f53affeaa2b05fbdfd6c27
SHA512

78d865d762ed560670acaac9f7cbb760865335b3cad7fcbb9db23784cd3fc57051ec27c658f266d90257b166529bfea1deb7d8507c38a8c3cbfbf2792a9964df
SSDEEP

384:6VCTTrRpbcevDYoxwYiZOaTKRPlWM8Qht1Jxfjl/DbRDVbdLNdnQRZhHmwZ+oJH0:6QcxonpP8QjD95bd5rr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\gdk-pixbuf-2.0\2.10.0\loaders\libpixbufloader-gif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\gdk-pixbuf-2.0\2.10.0\loaders\libpixbufloader-gif.dll,#1
  2⤵
  PID:2328