3b1e84e9452c52f4448e38eed17b5c280b5fe4ec69b631e712ff65e60e26c3f1

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 18:56

Target

libXau-6.dll
Size

20KB
MD5

b6f0655bed934503621fcf94ba449a19
SHA1

f0a5d9eefff5f3bcd2e23b9db748c50cffc1c6e8
SHA256

0da1f856d92d6b95f10ed8c3f629cd15468c906de9352fb4ae629139d1412eed
SHA512

77a10ae1748e5d76288c59933f3f41d4dc7a690b1f2bc9bff0b761f9f2c5331f868dc0259ffe4c4672e1806c33f3f9d0fe0a8b09b10e06333d2590f623c5b284
SSDEEP

192:vdBaTJcGAV5S55Nv8ekSoifItD33VBBmBJI3b5Ud5kbQbDTHlNspsorvgAFa2jf7:lBwcGAV5S55ZkBpTVTuI3dUd5GFoCJg+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2368	2484	rundll32.exe	29
PID 2484 wrote to memory of 2368	2484	rundll32.exe	29
PID 2484 wrote to memory of 2368	2484	rundll32.exe	29
PID 2484 wrote to memory of 2368	2484	rundll32.exe	29
PID 2484 wrote to memory of 2368	2484	rundll32.exe	29
PID 2484 wrote to memory of 2368	2484	rundll32.exe	29
PID 2484 wrote to memory of 2368	2484	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXau-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXau-6.dll,#1
  2⤵
  PID:2368