8f1a49544decb8ece3aed3a8ec474915b164221aa9f48d4f76bcc804d97d8ad1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 03:36

Target

orange/Image.dll
Size

36KB
MD5

e00a731a57067bc2a8d18a8904312218
SHA1

27e9840b67a8e6e80f53cf3f759c7df51e631c57
SHA256

57595c7eae3c44baaf0df83aca4495adcc3fe6cfb6f31fad0ba02e627de03eb2
SHA512

6cb28e5c5083151a412aeedf26b5fe649b46d1cac591a29e786535c754e7c069a3f5987d73fa98be30aa43a0cf0a1512a4deb60187a25d433b85b2f72a22997b
SSDEEP

384:plEkbmBIbfUkTkDE5xaCVIUzFGg9DU1BGpQwMbhhQ8xMbhh7UMEFBfJb8C:Qk5YCkDaxaCVdDH+JhhQ8chh7CP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2488	1976	rundll32.exe	28
PID 1976 wrote to memory of 2488	1976	rundll32.exe	28
PID 1976 wrote to memory of 2488	1976	rundll32.exe	28
PID 1976 wrote to memory of 2488	1976	rundll32.exe	28
PID 1976 wrote to memory of 2488	1976	rundll32.exe	28
PID 1976 wrote to memory of 2488	1976	rundll32.exe	28
PID 1976 wrote to memory of 2488	1976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\orange\Image.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\orange\Image.dll,#1
  2⤵
  PID:2488