370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 22:29

Target
shfolder.dll
Size 22KB
Sample240229-2ejs3aec91
SHA256 e69da5febb5a2932cbe731e32a5d7f6615bb987a119ef2cedead4555d86144e8
MD5 33c369a535290299ed5e5167cea37fdc
SHA1 4ea387cb55cada35de02738dfb324ab830d416f4
SHA512 581f2bf315c90e200fd621477d0192c6b3b4c51575b9d9f8c85114783c4425a7de221898055aa275068e4c6c5fb0458eb13a66b4512cc7499e7cc7843aaf9e78
SSDEEP 384:kqXjRYAhfBALfdpju122HoSHigH2euwsHTGHVb+d3HmnH+aHjHqLHxmoqQG0CHuz:kWjRLhZAL7juAL4+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1092	2832	rundll32.exe	27
PID 2832 wrote to memory of 1092	2832	rundll32.exe	27
PID 2832 wrote to memory of 1092	2832	rundll32.exe	27
PID 2832 wrote to memory of 1092	2832	rundll32.exe	27
PID 2832 wrote to memory of 1092	2832	rundll32.exe	27
PID 2832 wrote to memory of 1092	2832	rundll32.exe	27
PID 2832 wrote to memory of 1092	2832	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\shfolder.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\shfolder.dll,#1
  2⤵
  PID:1092