84d9db5140c905cc657102dadde82b6b108b6011bb75d8234703c96ea3bad214

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 11:32

Target

SecuriteInfo.com.W32.MSIL_Kryptik.JGC.gen.Eldorado.23056.30411.dll
Size

303KB
MD5

d47c871717a0b6e46c99b9b52bf2777a
SHA1

648c9564296ce068bebac44a8b47104258ffe0ec
SHA256

84d9db5140c905cc657102dadde82b6b108b6011bb75d8234703c96ea3bad214
SHA512

717fe2daee17c1b990421b50570730d5252cf6ef0c2b9f8e71ca46b3bacdd5ce3d9123ae56b7ca1ac2113fa646953f707b68c715b1d1c7ff4dc41689e77c28fa
SSDEEP

6144:Od1FDORwzACZZwmfAltULiNyrHjdD+/ncz:O9ORwzAKeJ/cz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2968	2152	rundll32.exe	28
PID 2152 wrote to memory of 2968	2152	rundll32.exe	28
PID 2152 wrote to memory of 2968	2152	rundll32.exe	28
PID 2152 wrote to memory of 2968	2152	rundll32.exe	28
PID 2152 wrote to memory of 2968	2152	rundll32.exe	28
PID 2152 wrote to memory of 2968	2152	rundll32.exe	28
PID 2152 wrote to memory of 2968	2152	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.JGC.gen.Eldorado.23056.30411.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.JGC.gen.Eldorado.23056.30411.dll,#1
  2⤵
  PID:2968