0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 00:13

Target

components/foo_infobox.dll
Size

252KB
MD5

e0a40baa1923fcad120d00b9073a9e30
SHA1

c9852623fa7794d556bb36d35e7c79df9120165c
SHA256

9e8b3de24fd6fa2eeac14647eac46843e033a4ba18e00bd3e4593cd001772c03
SHA512

c0884c2d02a971313270a5bf14bf70904fd0e173061781672692189b646a44782bc3a914aa32cf0b8642197a5d5ba48fbe200b74a436ec3e59554468d825e566
SSDEEP

3072:JId+zFyT0U9yaLfOdl6iwoWPv5+5EqJ83w2ZGcJZYNGpJVf5Ag0FutkfSqtxf7oq:680J3J2OVRAOtkfD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_infobox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_infobox.dll,#1
  2⤵
  PID:2952