04ec958a0deaa98fe9925e4644c5475b8a4608ad80b7dfc534f84dad446f814f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 21:40

Target

$PROGRAMFILES/alotappbar/bin/alotappbar.dll
Size

95KB
MD5

28a796d53ae2fb495a90897d4d272b06
SHA1

85ba778752cbdb3d470948a127ed37c275973ec7
SHA256

78764b12aa86d72a82993794114ce184a48a25f859388c792cf1eeb05cf7ab67
SHA512

0dc4e4ee8627723a15875788c2fbb213ed2404b0020a4b9e1b2ad16034e9d903956d3bf3bf7f8a7476d4879443f7a3da589021d238fed52505f016ce710042fe
SSDEEP

1536:B/Jk3DB5RovvehBtW+35ZKsO/XVAb2yI+rsmmasRCKINmkfQ9ImtvdNktcpxzQXa:lJEB5RaSNjy/aTI+Ymmah8/9IvG/pRz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\alotappbar\bin\alotappbar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\alotappbar\bin\alotappbar.dll,#1
  2⤵
  PID:2544