f6de40a0e0c5b51daa70456189d10f7fc1e7dcd36168cf8afcb17035efda6686

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 10:26

Target

host/wmpf_host_export.dll
Size

1.8MB
MD5

557263e28dc6c1416cea8b43a9a47282
SHA1

bb2306ef4e99dc0b10aa8ab51bb2872ed2a5d45a
SHA256

d40ebacc2c08b72aa48dbe613ef2bc4cfe65bf0fcd63254239308fc4ae0eb226
SHA512

b8fd24c566d770a452ecb5d227ccfe2ae8afc37d1c797d064adda63ec34a606c3ac882b2a366e4828c5c4869e249e2cf9dd9852185d63da9ff4bfc6c71c3d686
SSDEEP

24576:e+JpOhdC4YyHBU8p4aolR7esO2YgdlnL6tO/MbcTuMilTfYR01Is0B2o5pvy82+f:kC4YyHBP4DesjgsYOmP0B1i+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28
PID 2692 wrote to memory of 2600	2692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\host\wmpf_host_export.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\host\wmpf_host_export.dll,#1
  2⤵
  PID:2600