4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 05:47

Target

$PROGRAM_FILES_COMMON/Borland Shared/BDE/idbat32.dll
Size

136KB
MD5

2538200ecc0d8023a78799b47dec87a9
SHA1

21b3ea7043fa1482aad7dddbb4ef231c22e14a18
SHA256

c616fe3782c16734e969d809c407d9d15620d5bc7177e5f619309b9b74125904
SHA512

556589952eecdc1cda3878229cdf9b27f3f2f3c5e7b1d7515cb43b3daf898f021eaebafe5d2cca0f96f16f7546653fa068d1eefcdf44964e03b582a36f695e3c
SSDEEP

3072:RC+I6OzXQNwxgT4HEM7yczHn1EqZRE80mSAUVF90pypyqiIRzwOJhV1MbPHLhWzI:01ziwxgT4HEM7yczHn1EWp1YRgHLhWzI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1908	2080	rundll32.exe	28
PID 2080 wrote to memory of 1908	2080	rundll32.exe	28
PID 2080 wrote to memory of 1908	2080	rundll32.exe	28
PID 2080 wrote to memory of 1908	2080	rundll32.exe	28
PID 2080 wrote to memory of 1908	2080	rundll32.exe	28
PID 2080 wrote to memory of 1908	2080	rundll32.exe	28
PID 2080 wrote to memory of 1908	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\idbat32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\idbat32.dll",#1
  2⤵
  PID:1908

memory/1908-0-0x000000004C1E0000-0x000000004C209000-memory.dmp

Filesize
164KB

Download