2cee2d93aa2c8c207d4f75dac4af89cbc88eb503562a346153593d31929d4f97

Analysis

max time kernel
1558s
max time network
1558s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 06:59

Target
$PLUGINSDIR/SpiderBanner.dll
Size 9KB
Sample240127-hr77msfdc2
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1
  2⤵
  PID:1676