0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 00:13

Target

components/foo_ac3.dll
Size

158KB
MD5

86c0604ea6de31ff978dea7eeb235d9e
SHA1

1feeae651de1312880296c35c3e4273bb62b4a78
SHA256

7d60462a9f442c6433b0bdcbc6349ce4962fe0828f6c64101b107e9cf907900b
SHA512

9f6f70b6cc387e096aabf3b618f614152917fcca4763c7ff77ce3dbc1595e2192df40eacc4d54b2bab89124b34cb9351490ec0e428e5c8dda40d5b9fad0d1353
SSDEEP

1536:pRH33UTpGsix0FxMgh3f58tkAGwoZ+3djmfGSY1dFo0H83lFoxG1xNkgXc1ZAmtR:nH33UQVH1djjdSL3lFp1JH+qdtEMv+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2940	2820	rundll32.exe	28
PID 2820 wrote to memory of 2940	2820	rundll32.exe	28
PID 2820 wrote to memory of 2940	2820	rundll32.exe	28
PID 2820 wrote to memory of 2940	2820	rundll32.exe	28
PID 2820 wrote to memory of 2940	2820	rundll32.exe	28
PID 2820 wrote to memory of 2940	2820	rundll32.exe	28
PID 2820 wrote to memory of 2940	2820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_ac3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_ac3.dll,#1
  2⤵
  PID:2940

memory/2940-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2940-1-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download