24d824fb3eacf87429dfc236d3c491dfaa13ed412c4aae09de1aea967f3191e7

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 06:23

Target

$TEMPLATES/statistics.dll
Size

528KB
MD5

d96eb3c463e3d79bde702cabb882d2e3
SHA1

952c4a91492478d6e99dc18557f02873df400a69
SHA256

59fa6395e5752ce5fa4d077b0174c05ffd53607b0dde03e041ff8c2a746c86b0
SHA512

ebe922743a26dac2c8058a77dc7805006917fa2f95b83f257b2b3d734e1d346f7d3ad460fee02d39c2399dbe2ec26b4bd20f8ccf7858f0feeb8a43c6cc5d62df
SSDEEP

6144:00KrP3aHbaBGCUiSG1IMo9G3mMDlKyoGMojHgDpokrJvgEwId4bF1sdJJT:00KDq7s/9S8zygbgDpoyJvddh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2248	1084	rundll32.exe	28
PID 1084 wrote to memory of 2248	1084	rundll32.exe	28
PID 1084 wrote to memory of 2248	1084	rundll32.exe	28
PID 1084 wrote to memory of 2248	1084	rundll32.exe	28
PID 1084 wrote to memory of 2248	1084	rundll32.exe	28
PID 1084 wrote to memory of 2248	1084	rundll32.exe	28
PID 1084 wrote to memory of 2248	1084	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPLATES\statistics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPLATES\statistics.dll,#1
  2⤵
  PID:2248