4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 05:47

Target

$PROGRAM_FILES_COMMON/Borland Shared/BDE/idasci32.dll
Size

113KB
MD5

ec39e51fa91da0a79aabdbb1ffc77bad
SHA1

6ed43f2f256d0aa38efb93f10d3ecb096efb61bf
SHA256

d01b27eb0da5f83c920f869cd4d8274039e5cd49b80f52741a59c2405f80c0d5
SHA512

c7622f3d72e17ec536aa0355517bc8acd91dcf77b010fa6d790f4f3d43e922428af78153d60ab3443356fcd0bb82f4de4bf7b5f5d85a0698ee242125014b25e3
SSDEEP

3072:lhFeyBuyJ4AOUAnfM1ERRcePy9FR18fAbdMGUV:l/eyJlOPnf8EReFR18fMa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2180	2176	rundll32.exe	28
PID 2176 wrote to memory of 2180	2176	rundll32.exe	28
PID 2176 wrote to memory of 2180	2176	rundll32.exe	28
PID 2176 wrote to memory of 2180	2176	rundll32.exe	28
PID 2176 wrote to memory of 2180	2176	rundll32.exe	28
PID 2176 wrote to memory of 2180	2176	rundll32.exe	28
PID 2176 wrote to memory of 2180	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\idasci32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\idasci32.dll",#1
  2⤵
  PID:2180