8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:42

Target

scripts/wInputKBM.dll
Size

26KB
MD5

e191c7e728ae6455604fa21b4f98e114
SHA1

1033589898b1b5b6a502f1b9173e2d7065ce9984
SHA256

811d335ed15650fc3d05d14dc5b2f8ba3bc49cdaf44e7c85cbc6de299b037661
SHA512

a1e9a1cd9a898f700b5d5ef9ed7a68416f733aa6d7cc9daf9ab16f8e9057b42950bed7775ff5e54c6d6b6a53fbbff5466709d573431c3313286b5486817b6539
SSDEEP

384:Q8+M5KQjLvQzMDY5t8z8Yir+SzxWVxOAL3eGJuADdIKYhggf5Xec9Ksy644:QdM5KQIYMAZQzxWVxCec95yh4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wInputKBM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wInputKBM.dll,#1
  2⤵
  PID:2584