5158d1e92fe476227e9bc739cd15fff4e9e847d8598613a6ae220ce085e3a6fb

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:40

Target

$PLUGINSDIR/PrimoRedist/pxdrv.dll
Size

558KB
MD5

8f6f3aa814143099b431744b16845664
SHA1

67f518591a1cbb954a031cc7421faa1aeb25651a
SHA256

7c9449c2e774087305a28117e47fa48bbf33638144e9694f20d20fb15065ac9f
SHA512

5fdd908862dcabc37a794d0f7fe134e6df9f34d0e52cc69a535c37872a4f2edb44e2448654b3832a11f41fd57be36f1ad0f863603d1f268f99c6180a3a48bcb5
SSDEEP

1536:PdT7plr0Xh+r3xZMmourvvsjI9vW/dy1HW6Hfuj+aUfQe95QV88YfOr1oE0mIQ:PkQMmouQjI9v8NMi7UfQe95FOF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2128	2228	rundll32.exe	28
PID 2228 wrote to memory of 2128	2228	rundll32.exe	28
PID 2228 wrote to memory of 2128	2228	rundll32.exe	28
PID 2228 wrote to memory of 2128	2228	rundll32.exe	28
PID 2228 wrote to memory of 2128	2228	rundll32.exe	28
PID 2228 wrote to memory of 2128	2228	rundll32.exe	28
PID 2228 wrote to memory of 2128	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PrimoRedist\pxdrv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PrimoRedist\pxdrv.dll,#1
  2⤵
  PID:2128