147a342db53ebae2993dbdabdab97f47e99a542c733a0ed3fce06d60231ce7a7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 22:47

Target

$_1_/Modules/wis.dll
Size

42KB
MD5

875b93e5075b75fba8b080c578e9170c
SHA1

3e04baed759bafcf80a3edc7f16054739ceb1972
SHA256

3a942e2bfd313ecdbd48ebe05653b50d904f9b1dc30c86067446885a8d01dff7
SHA512

54c008a278de9fe898cc661393df22b62be9dddd31ab910e311a52ab7035b93949baeba7ff4fc40371061bdc6d9ac9ebc6dc5cd6e31050b44964e172162f6b89
SSDEEP

768:TkPmePU4gW1YH7FzxIT7JOB3+NI2giTcsuCGkjam54RZcCTRUf/HXNJxriD:TkPmePU4pKbBKT7JOIu9lUOsWZHT8/3g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1788	2960	rundll32.exe	28
PID 2960 wrote to memory of 1788	2960	rundll32.exe	28
PID 2960 wrote to memory of 1788	2960	rundll32.exe	28
PID 2960 wrote to memory of 1788	2960	rundll32.exe	28
PID 2960 wrote to memory of 1788	2960	rundll32.exe	28
PID 2960 wrote to memory of 1788	2960	rundll32.exe	28
PID 2960 wrote to memory of 1788	2960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_1_\Modules\wis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_1_\Modules\wis.dll,#1
  2⤵
  PID:1788