b4873ade58e22893042b36bdd7c1a3316364b6ddf52952117b0975f5237cb9cd

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 13:10

Target
libXau-6.dll
Size 20KB
Sample240224-qephrsdc7v
SHA256 0da1f856d92d6b95f10ed8c3f629cd15468c906de9352fb4ae629139d1412eed
MD5 b6f0655bed934503621fcf94ba449a19
SHA1 f0a5d9eefff5f3bcd2e23b9db748c50cffc1c6e8
SHA512 77a10ae1748e5d76288c59933f3f41d4dc7a690b1f2bc9bff0b761f9f2c5331f868dc0259ffe4c4672e1806c33f3f9d0fe0a8b09b10e06333d2590f623c5b284
SSDEEP 192:vdBaTJcGAV5S55Nv8ekSoifItD33VBBmBJI3b5Ud5kbQbDTHlNspsorvgAFa2jf7:lBwcGAV5S55ZkBpTVTuI3dUd5GFoCJg+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3012	1880	rundll32.exe	28
PID 1880 wrote to memory of 3012	1880	rundll32.exe	28
PID 1880 wrote to memory of 3012	1880	rundll32.exe	28
PID 1880 wrote to memory of 3012	1880	rundll32.exe	28
PID 1880 wrote to memory of 3012	1880	rundll32.exe	28
PID 1880 wrote to memory of 3012	1880	rundll32.exe	28
PID 1880 wrote to memory of 3012	1880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXau-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXau-6.dll,#1
  2⤵
  PID:3012