8f1a49544decb8ece3aed3a8ec474915b164221aa9f48d4f76bcc804d97d8ad1

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 03:36

Target

orange/StoneXP.dll
Size

83KB
MD5

5e884fb7224caa769d62dfdfaa77a689
SHA1

97a72b7f558a9c44c5265473682a72d6cb967420
SHA256

3e8b4fd235a4704e3481fc9cdb86594a9b7143509688eac41d5a9776bdaf2815
SHA512

d157697fd66712c4846ceb441a89ebafbf899a2a38b28c62401440f58a078546a1ca39e84cefb61fd7df34c8e183a96750ef1a6e5315ee38fe1ccd7e0deef59b
SSDEEP

1536:26666666oO5Q40ep3jkgXmKf1rz48ul0rjIno3Ulzr/zz38QkqmHF4voYilUVz4t:B+Rv0rjLszr/iXUKYv1fUbsP8f84svFm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2752	2420	rundll32.exe	28
PID 2420 wrote to memory of 2752	2420	rundll32.exe	28
PID 2420 wrote to memory of 2752	2420	rundll32.exe	28
PID 2420 wrote to memory of 2752	2420	rundll32.exe	28
PID 2420 wrote to memory of 2752	2420	rundll32.exe	28
PID 2420 wrote to memory of 2752	2420	rundll32.exe	28
PID 2420 wrote to memory of 2752	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\orange\StoneXP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\orange\StoneXP.dll,#1
  2⤵
  PID:2752