584c8cebd10c8c65ba296ca76e8008fb24c708690a5af3d55d384e9fd5ca768b

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 03:57

Target
$PLUGINSDIR/Banner.dll
Size 481KB
Sample240321-ejenksbd37
SHA256 f83eaa95ef4be864b9f425d3c07b450741793d92cdd73b891410dbc5e250d0fb
MD5 a12e31793e1dffd9fba527c30c275c74
SHA1 07b0d01734bd782a59796185ed6f9f1bc2c40e5b
SHA512 9e929a6a4a62b222ca38b4ad3ea808391ffa8baa15d325f2771cfad2a46b3125ee955083b206be8fca44570127ed304205efa59ac3db7b2e18f97c10a24e42e2
SSDEEP 3072:fWeEeexeeheeZeeWee/ee3eeHeeFeeKee5eeleeBeezeeKeeeKeeFeeQeeEeezev:sDTbePn5ojie4suBYLzA8zjZGe6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1
  2⤵
  PID:2552