0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 00:13

Target

components/foo_codepage_action.dll
Size

96KB
MD5

6e2bae7969e481ce1faff6865733e596
SHA1

a31f85bd31b6a8cd92c0da82437230e7a39a0ae2
SHA256

3ebcb64f993238be55250259f8e72d41d89c03f223b4fd6ee7c94277120cfb80
SHA512

eba9d072e7ded75f5ba5cae14a7fda601df9437561c84a009d44db8616ba842c1ffd5c8ce9e3ee82e67ab997c902f3f40229d8f76615faa8023972beac792c02
SSDEEP

768:hXvDGuFbPKv2PDSMBK/O0ghpKAKudn86neefN7nXlopFsjVOpJLkmte6D+J9Sjlb:M2EN8WOqAKifTn1ocjkVkmjDeet19t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2212	2144	rundll32.exe	28
PID 2144 wrote to memory of 2212	2144	rundll32.exe	28
PID 2144 wrote to memory of 2212	2144	rundll32.exe	28
PID 2144 wrote to memory of 2212	2144	rundll32.exe	28
PID 2144 wrote to memory of 2212	2144	rundll32.exe	28
PID 2144 wrote to memory of 2212	2144	rundll32.exe	28
PID 2144 wrote to memory of 2212	2144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_codepage_action.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_codepage_action.dll,#1
  2⤵
  PID:2212