0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 00:13

Target

components/foo_dumb.dll
Size

520KB
MD5

f97dccc1c8e1062cd1746b35ccc5511a
SHA1

93360c193da0d5d4eaa158766eeccf04d00bd50d
SHA256

53a90f4beb5f7b1525bbaf05c81e0af2de1722793ce85539cfdeaec52e7ffea2
SHA512

04bd32f1aa301e0575b73b5eba3c619640ccfc90e154d0121a26d71492992b4446c3512a7ccd682d4807fc32fd5faf3bba39002aa3f9eb1594ab217db15ff09c
SSDEEP

6144:cztiqFf4eoV2YZ0kONQbmnUs/1IjtKoSYBG6IuSgfOEC4uEwrfINTBaFAOWeO4h:PqFToV2YHwrfINTcFN9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_dumb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_dumb.dll,#1
  2⤵
  PID:1728

memory/1728-0-0x0000000010000000-0x0000000010089000-memory.dmp

Filesize
548KB

Download
memory/1728-1-0x0000000010000000-0x0000000010089000-memory.dmp

Filesize
548KB

Download