cdb348263e0234cb47403fcfdc32105f645508afd1493b7891f96c20d0c3024a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 07:33

Target

utils/GreenLuma/GreenLuma_2023_x86.dll
Size

411KB
MD5

892177180f9406856fdd56a17295cfa6
SHA1

869079074f99ef35fc4e1435848b1eacff6d6fca
SHA256

339e0000e61f00f7b9ad7136715d565bd685c28b632025c549e429f392f7f1e0
SHA512

4e9c26bc720399c22940d49cf45c854f7c3c5a9db94d87de2a28daaaa7226b03dbe59c2c5abaa6044e72f441c710e52cb571afe1e6a2dd92ef895131cc0ba9e3
SSDEEP

6144:w9ySoWFjdTHCBmuXqpnIsA90NWg6zTy4zze7oeKg1BnW6z:hSoW9dTH+s9A90yz2oQBnRz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2480	2356	rundll32.exe	28
PID 2356 wrote to memory of 2480	2356	rundll32.exe	28
PID 2356 wrote to memory of 2480	2356	rundll32.exe	28
PID 2356 wrote to memory of 2480	2356	rundll32.exe	28
PID 2356 wrote to memory of 2480	2356	rundll32.exe	28
PID 2356 wrote to memory of 2480	2356	rundll32.exe	28
PID 2356 wrote to memory of 2480	2356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\utils\GreenLuma\GreenLuma_2023_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\utils\GreenLuma\GreenLuma_2023_x86.dll,#1
  2⤵
  PID:2480