b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 15:27

Target

TwistedBrush/clipboard.dll
Size

44KB
MD5

6eb8113fb62f5bf255726d1520017c29
SHA1

1480b5a537788bdb663ae4db242572a89ac1ce1d
SHA256

64c6dac03c8a8206d95d7bcd44e28e3d2459542b0a40556908a03fd421298032
SHA512

5d4f3d6a3239af25aa1deb83e01af360d9982683907fce6723db2d98a5bca146da7a4ac19004c3d56ca221b571ce49a5c3667bb31b9713966a05a60b5185bb43
SSDEEP

384:IQFzgkrKTf1y2G5qqxCLHlsnWL7ju0Mrh3TyTrFHWui+cA/8oJTQ8:I+bWTNy2GgplsnWLuhTyFHWI/8oJ7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28
PID 1580 wrote to memory of 2616	1580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\clipboard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\clipboard.dll,#1
  2⤵
  PID:2616