d72702999c526afaf6f6341889d5a21dd02595c6108e040b8d8f75a03d4c5f5a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 17:21

Target

$APPDATA/mIRC/bin/dll/mircustom.dll
Size

4KB
MD5

bfe2cf7876a8d40e43557694ec1d3f6e
SHA1

784634fb52be39de93c363626823c28a88bad56e
SHA256

c1602aa533fb2a4261fa6174ef32d66e91e325bf8b6ee8d7487e74e2982d1183
SHA512

65dad85242b2fa6fc720062ab4ae8c6539bad779326f264aa841b3941abd471f9720a6b0a1c59a1824214b783eefbb7bbb3cbe3b9fd0aa731287af5d87cf57ea
SSDEEP

48:SPWzS0AA0BfNRfC4XtMZ6159JzUjbl42vVaE/pbn/P0lwGQdN5u25h:ugS0Z05e49w6X9JQbl42NP9vdG2P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2520	2756	rundll32.exe	28
PID 2756 wrote to memory of 2520	2756	rundll32.exe	28
PID 2756 wrote to memory of 2520	2756	rundll32.exe	28
PID 2756 wrote to memory of 2520	2756	rundll32.exe	28
PID 2756 wrote to memory of 2520	2756	rundll32.exe	28
PID 2756 wrote to memory of 2520	2756	rundll32.exe	28
PID 2756 wrote to memory of 2520	2756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\mIRC\bin\dll\mircustom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\mIRC\bin\dll\mircustom.dll,#1
  2⤵
  PID:2520