be68c54bf25595d493a529c7f64ea38629b44f07c4551c208752b0b57060e2ae

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 22:07

Target

ROIntegration.dll
Size

697KB
MD5

fa958546404323c023d0171a90c4689b
SHA1

1c765a9f59b89cbd3015ed171ca65134fa7941ba
SHA256

2c107c82ab4a63b6280f85396183940ff0fdd88f8c3013263fc1804dd8cb7e18
SHA512

23bf9bf0ffa8df83f491add0479562fbce219b2bfde4ce30929c0d63ea7d84a691b1999cac8a7c9d49c4593743ebe5a4cb3f98ea089eeea613f4aabc4645085f
SSDEEP

12288:c/qsoRf3QMb7aDdEVtM9wzbeFp5bcP8oVCJHsu7ueyaYzIN888888888888W888c:c/qzRf3QMb7aZAtM9wzbkpHlII87

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2620	2320	rundll32.exe	29
PID 2320 wrote to memory of 2620	2320	rundll32.exe	29
PID 2320 wrote to memory of 2620	2320	rundll32.exe	29
PID 2320 wrote to memory of 2620	2320	rundll32.exe	29
PID 2320 wrote to memory of 2620	2320	rundll32.exe	29
PID 2320 wrote to memory of 2620	2320	rundll32.exe	29
PID 2320 wrote to memory of 2620	2320	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ROIntegration.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ROIntegration.dll,#1
  2⤵
  PID:2620

memory/2620-0-0x0000000001C80000-0x0000000001D3C000-memory.dmp

Filesize
752KB

Download