9a33ff3deea984165327d7334e3cffa8df23aebcc1d1c0aa144044a52df35421

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 09:52

Target

appdata/plugins/wiki_search/wiki_search.dll
Size

125KB
MD5

bc7b6da51d09bf45648fd6cebf8618c7
SHA1

18344e96f725e74dc2b67971aed537f6a5be95f7
SHA256

6d4c5dfddbe7c7077163b713dfff3cd13fe681bfd457e3a9c24d8ba830f9866f
SHA512

f9ef72571168fc64129c8049add306265ef561f81724720d7ce163d14067f225f412169a71749f04803e7f0cc7ba9cf1459698cd9bd01b90679a9921112f99fc
SSDEEP

1536:3LyYFh9t1LbAIaEc+UqbPzwY+vuhvHhcwZd/fL57CL8LSqHaBpy5Z/bUkL:3LyYFh9PLbA8UOGuHRxoIOq6Hy5ZY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2208	2384	rundll32.exe	30
PID 2384 wrote to memory of 2208	2384	rundll32.exe	30
PID 2384 wrote to memory of 2208	2384	rundll32.exe	30
PID 2384 wrote to memory of 2208	2384	rundll32.exe	30
PID 2384 wrote to memory of 2208	2384	rundll32.exe	30
PID 2384 wrote to memory of 2208	2384	rundll32.exe	30
PID 2384 wrote to memory of 2208	2384	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\wiki_search\wiki_search.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\wiki_search\wiki_search.dll,#1
  2⤵
  PID:2208