0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 00:13

Target

components/foo_input_monkey.dll
Size

275KB
MD5

1506724884a344a4733c510a0de7f61d
SHA1

244f8512c3f9cc36ed5f151715cb7d9ea3be8a46
SHA256

72daa2ed96d11714af3c06d213f7802d9cdb4b32eb89acf61fdf3dd22e7298a8
SHA512

a910d3205c90bcbd316825212fda3c13a71dc9b2a17f1cd2fdddc9fdbcae255c8a0960940c608395886f50b7c1a1893728ec622c302ae91d704bd5a195eb8d81
SSDEEP

3072:Z2wymRaQj32VxLmiEgvSunRgV2SS4K87MNac3D79rTJdPUjdPUA0AQAg0FusbftE:N8Qa6ISrK8sRTRUCAOo7T

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2244	2184	rundll32.exe	28
PID 2184 wrote to memory of 2244	2184	rundll32.exe	28
PID 2184 wrote to memory of 2244	2184	rundll32.exe	28
PID 2184 wrote to memory of 2244	2184	rundll32.exe	28
PID 2184 wrote to memory of 2244	2184	rundll32.exe	28
PID 2184 wrote to memory of 2244	2184	rundll32.exe	28
PID 2184 wrote to memory of 2244	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_input_monkey.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_input_monkey.dll,#1
  2⤵
  PID:2244

memory/2244-0-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/2244-1-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download