e7bf5558d5445eb2f7e3d0cd4001a54281293f98230b23522f6d444afa4bc9eb

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 23:29

Target
libXdmcp-6.dll
Size 28KB
Sample240227-3gywfaeb44
SHA256 7705851ba047a8154402aca92621b60be0e0e9d9b52b19bf8be540305bd53dba
MD5 7d4f4d3bc6ab6c3ea2097a7ecd018728
SHA1 2434fbad089ac85eda43c0b0e911ab437b4dfe63
SHA512 f9b64cbcd7c7c7b4e942c3da74fb280762d038f974fc23d1e0431b15787aefc87464cda121aa8fccf499af46e345dd65aa5fb5cfee1cb45dba6e5dd79b01a1d8
SSDEEP 384:sEZJxxKcB6SOd08J0DBljbG4H80iIOitbr0iIOi1Nk6qTdOoTcFbf3IU2xRov+h2:sEYWnJH80Qi0Q+ZOcFDR27e
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2732	2120	rundll32.exe	28
PID 2120 wrote to memory of 2732	2120	rundll32.exe	28
PID 2120 wrote to memory of 2732	2120	rundll32.exe	28
PID 2120 wrote to memory of 2732	2120	rundll32.exe	28
PID 2120 wrote to memory of 2732	2120	rundll32.exe	28
PID 2120 wrote to memory of 2732	2120	rundll32.exe	28
PID 2120 wrote to memory of 2732	2120	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXdmcp-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libXdmcp-6.dll,#1
  2⤵
  PID:2732

memory/2732-0-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download

memory/2732-1-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download