b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 15:27

Target

TwistedBrush/_ISource30.dll
Size

1.0MB
MD5

2384f086121dcd5ca9ea74cc6ba24559
SHA1

e680eef7227001286e5330eebbacab7e98760aa0
SHA256

ec89c44da35d3c592a601a804672de4d613627f706f42a9b4b06c9a60d40366a
SHA512

ecba6e37f838231ef452c126239f920be6294cf3e5293e64191b0943f44ebfa6dad001ef834fa7de785d13e0b9bcc7f8cc3cb23ee17b9b1acd3998aeab187229
SSDEEP

24576:RznYWOzS6CN6h8rRLNMhZ8iL7bmfVW1C4ySwn+nbYfb6a2NjcTrnyixSi8u:pYWOzS6x8NiDfb0VgyzT3Tryix4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1064	2940	rundll32.exe	28
PID 2940 wrote to memory of 1064	2940	rundll32.exe	28
PID 2940 wrote to memory of 1064	2940	rundll32.exe	28
PID 2940 wrote to memory of 1064	2940	rundll32.exe	28
PID 2940 wrote to memory of 1064	2940	rundll32.exe	28
PID 2940 wrote to memory of 1064	2940	rundll32.exe	28
PID 2940 wrote to memory of 1064	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\_ISource30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\_ISource30.dll,#1
  2⤵
  PID:1064