e96554dfad4b56587d0e07c45813b8ed55956de8b1566995666445d63a50cca9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 10:00

Target

$COMMONFILES/Angels/Scan.dll
Size

1.0MB
MD5

05997d634ce44960171a25c0c480a085
SHA1

df9d003bd6cac99accf8e8d15b491eca2f8e216c
SHA256

e44d1bd72bcd56ee6ccf75831d3540807859a23792e42943c82e588d1ace9905
SHA512

d14146afebeb5bd93b6ed9eebc5f109014dbe78fc6f7a25fc0dfeacfa8876c0b5c40cee1d249932ffb788ba447ada99ccd8fa1f864cf29e27ab57c2aaaa13bfb
SSDEEP

24576:CgcIwdCFEXGwz6Ff78H8KZ7SI7ErlB6azPTkkkkkkkkkkkkkkUkkkkkkkkkkkkkh:CgcIwi5nQ24Erey

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28
PID 1444 wrote to memory of 2516	1444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\Scan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\Scan.dll,#1
  2⤵
  PID:2516