5158d1e92fe476227e9bc739cd15fff4e9e847d8598613a6ae220ce085e3a6fb

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:40

Target

$PLUGINSDIR/PrimoRedist/px.dll
Size

682KB
MD5

dbb66b386c194a58e29e49d7ebbebe65
SHA1

78dced6be8870938a2c8fefb1b5b884159e5fb21
SHA256

309a40e28271eee4e41cdb5cd1f83c0087702d42f9fc3a87d62f9f30dd53d68d
SHA512

6a49783c86f2bdb6cb522f0e53a6e653eccb89b1a2d0d800bfae499d304cad173f621d9dad7765a13848a1e8bc4da355d94fc1a4bbf2beb5c4d999ea79257764
SSDEEP

12288:YhT+GE8INwK4VhupUoh/o/mKg8+ncSFL1T5iU2DF6mHmzazrr32ceMtw/g+CB:YhSXjz8hupUotimPcSFLwjeMtw/g+CB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2140	2248	rundll32.exe	28
PID 2248 wrote to memory of 2140	2248	rundll32.exe	28
PID 2248 wrote to memory of 2140	2248	rundll32.exe	28
PID 2248 wrote to memory of 2140	2248	rundll32.exe	28
PID 2248 wrote to memory of 2140	2248	rundll32.exe	28
PID 2248 wrote to memory of 2140	2248	rundll32.exe	28
PID 2248 wrote to memory of 2140	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PrimoRedist\px.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PrimoRedist\px.dll,#1
  2⤵
  PID:2140