869541ca9aceb4c04bc41e906e07e2e266ebf52e1c8fd95b919b0c9bc5aa2ec6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 05:06

Target

gxyav.dll
Size

372KB
MD5

44b437b1057c1aa6562621c75690eec7
SHA1

7f46a1a89790e8e6167deb1afebb37f247ba9704
SHA256

cb8d9b967dc53146da6b9d569b70cbd99e6786dc654ec389e5af3ba0c4f34bb4
SHA512

a324c6e47164b2900e7c80dcbefd17367c0c9460e1faf985295a2890840b8da6db42e98b56db43d2a4f14d89ad5c4b66d714b35d29e152a8d4cbbdefae3972c8
SSDEEP

6144:ATXI52oGMuDZwubuXtZQrGBAp5vTToYBcUBRUqTyhR4c4frha7rZ5Zu0zZ/DlObh:A85/GMeWuq/Sp5vT4ERnyhi/FaI0zZbu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1704	2052	rundll32.exe	28
PID 2052 wrote to memory of 1704	2052	rundll32.exe	28
PID 2052 wrote to memory of 1704	2052	rundll32.exe	28
PID 2052 wrote to memory of 1704	2052	rundll32.exe	28
PID 2052 wrote to memory of 1704	2052	rundll32.exe	28
PID 2052 wrote to memory of 1704	2052	rundll32.exe	28
PID 2052 wrote to memory of 1704	2052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gxyav.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gxyav.dll,#1
  2⤵
  PID:1704

memory/1704-0-0x0000000010000000-0x000000001017E000-memory.dmp

Filesize
1.5MB

Download
memory/1704-2-0x0000000010000000-0x000000001017E000-memory.dmp

Filesize
1.5MB

Download
memory/1704-1-0x0000000010000000-0x000000001017E000-memory.dmp

Filesize
1.5MB

Download
memory/1704-4-0x0000000010000000-0x000000001017E000-memory.dmp

Filesize
1.5MB

Download