271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8

Resubmissions

29-02-2024 21:17

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 21:17

Target

AutoUpdate/AutoUpdateUtil.dll
Size

198KB
MD5

d585f6453c8f564da8db0573ee311e0e
SHA1

81df64177e63f98ceb9f6a4e0f002493abfc1e57
SHA256

ef09b83ce0becbae769a323037e8cd9922a1f57f3fe0fd1f92957cea232f4913
SHA512

a5973907c6ab1fa956a76a107957d59952a49b190c1e4dd82b7c49796516b896d59e256dd94ca0bf56d088dabe53d1681ebfeda3405dc47646c1c33d461dd153
SSDEEP

3072:dOq3B8kyfQQC2mC2gbvCsGowP96rH0Vu3b1vJ4gMdzeVj+3O1fnMw:Qq3BJ4vCCa9Vgxl+GvM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2168 wrote to memory of 1880	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 1880	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 1880	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 1880	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 1880	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 1880	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 1880	2168	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1
2⤵
PID:1880