8257389d6264742d414404beaaaac869336c91f9f9af1e31ee081aa6e7857f3c

Resubmissions

19/01/2024, 19:16

19/01/2024, 14:16

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 14:16

Target

lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-pcx.dll
Size

21KB
MD5

958ab35a3f720c5875c536812816bf49
SHA1

fff1f7f543b9bb5f9b81979414fbdf758b856a9e
SHA256

6930e5439ba9191ac02419fbb64a6f09f17058c63d5de134eb6b4ccdb491ba0c
SHA512

296082d1dd892d8b96522c4bdb563a7b81746616c67722dc3195bebac9a3e64f0c5e36127eb75fbf80c5d6436f16bcdfa50b04415d7c78ff6df654763b6cc903
SSDEEP

384:NmQwu0J2Ui7FwmfsDYaxLVynS4WcgRPbLnQ:Nm0y5LVUSHPbLnQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2748	2320	rundll32.exe	28
PID 2320 wrote to memory of 2748	2320	rundll32.exe	28
PID 2320 wrote to memory of 2748	2320	rundll32.exe	28
PID 2320 wrote to memory of 2748	2320	rundll32.exe	28
PID 2320 wrote to memory of 2748	2320	rundll32.exe	28
PID 2320 wrote to memory of 2748	2320	rundll32.exe	28
PID 2320 wrote to memory of 2748	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\gdk-pixbuf-2.0\2.10.0\loaders\libpixbufloader-pcx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\gdk-pixbuf-2.0\2.10.0\loaders\libpixbufloader-pcx.dll,#1
  2⤵
  PID:2748