67001c8f5a37c1ccd2d1750f21e28d372a8639c330aafbae111a5956c942b71a

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 09:30

Target

driver/w2K/driver/mv2.dll
Size

20KB
MD5

6418ef69bb990e927aae501cadc9dba5
SHA1

ea46d81ad856ce627382c24a375f9a437b6f1bfa
SHA256

252a2e729cc0acf723034be59acce66b9ffaf6c0cb4b3f9ae6206f5e36955600
SHA512

619a14919d86a8f3e7ea7400ff60a64eda10cb793fcbca2001531af443e381a5a8ccd8b4873b567ce110f7ead8fa4c5e06c263ab7a220a694a7c2fc2e1c138bf
SSDEEP

384:KQpVhD4isesPZlFwQUWeFtdg4uS8fHt9cdI/pPsTlz18j+dEaNE54XdUb+vr+hw:KeeesRlFwQg1buSCH3cWNsTnC++ivr+S

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2588	2092	rundll32.exe	28
PID 2092 wrote to memory of 2588	2092	rundll32.exe	28
PID 2092 wrote to memory of 2588	2092	rundll32.exe	28
PID 2092 wrote to memory of 2588	2092	rundll32.exe	28
PID 2092 wrote to memory of 2588	2092	rundll32.exe	28
PID 2092 wrote to memory of 2588	2092	rundll32.exe	28
PID 2092 wrote to memory of 2588	2092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\driver\w2K\driver\mv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\driver\w2K\driver\mv2.dll,#1
  2⤵
  PID:2588

memory/2588-0-0x0000000000110000-0x0000000000114000-memory.dmp

Filesize
16KB

Download
memory/2588-1-0x0000000000110000-0x0000000000114000-memory.dmp

Filesize
16KB

Download
memory/2588-2-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download
memory/2588-3-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download