8257389d6264742d414404beaaaac869336c91f9f9af1e31ee081aa6e7857f3c

Resubmissions

19-01-2024 19:16

19-01-2024 14:16

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 14:16

Target

lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-png.dll
Size

35KB
MD5

b461608371e68adbd23ee02792a384b5
SHA1

328953f7b0853fd79ee9bb5ad48a32599e9af768
SHA256

ee7815e7ca016d5a1d7796080f64dd5280793b2398f4477de085f75a2d82a441
SHA512

3a56c9b30654d9b000a2bfd2ecacbd636113584ef68b1e187b5bae3108b8789888dbc5c7af8587f69f6a19571ea91905d7370840fc7bca672cc71d1ce99c63d3
SSDEEP

384:iGdTsz3ycKA4nUHYLpl8IBU6amDFxxnZv4Wkj:iAAWUYpaGT7nZgWA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3056	3036	rundll32.exe	28
PID 3036 wrote to memory of 3056	3036	rundll32.exe	28
PID 3036 wrote to memory of 3056	3036	rundll32.exe	28
PID 3036 wrote to memory of 3056	3036	rundll32.exe	28
PID 3036 wrote to memory of 3056	3036	rundll32.exe	28
PID 3036 wrote to memory of 3056	3036	rundll32.exe	28
PID 3036 wrote to memory of 3056	3036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\gdk-pixbuf-2.0\2.10.0\loaders\libpixbufloader-png.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\gdk-pixbuf-2.0\2.10.0\loaders\libpixbufloader-png.dll,#1
  2⤵
  PID:3056