5158d1e92fe476227e9bc739cd15fff4e9e847d8598613a6ae220ce085e3a6fb

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:40

Target

$PLUGINSDIR/PrimoRedist/pxafs.dll
Size

130KB
MD5

e66569100ada3821d49be51109fa111c
SHA1

da0d6e0d9073b7d384e410916ae0306e16eee23a
SHA256

b7c5e5cdb6bf6fc01d1823b6aa1b0fef62f1e594886e2797a00a03809589c0f4
SHA512

981128e378ff2c286ad0aa9ca0012fc72cace283b0bbe4bb21ec7429735ef0b4438a6c6ff8dd3ac11438e25af33162f320a085223d6fcc41f5a7b060d88efb8e
SSDEEP

1536:+QfvGEOg5r766WHTPnqMtpdJn16oYvXfR8zVULjePWwxfFkEba89lb6Oe6FoHkPE:+Q2d2WzPqeaizVUcva89lbxefH4E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2056	2948	rundll32.exe	28
PID 2948 wrote to memory of 2056	2948	rundll32.exe	28
PID 2948 wrote to memory of 2056	2948	rundll32.exe	28
PID 2948 wrote to memory of 2056	2948	rundll32.exe	28
PID 2948 wrote to memory of 2056	2948	rundll32.exe	28
PID 2948 wrote to memory of 2056	2948	rundll32.exe	28
PID 2948 wrote to memory of 2056	2948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PrimoRedist\pxafs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PrimoRedist\pxafs.dll,#1
  2⤵
  PID:2056