081b2455cbf464eee43082d023137137eaf43b7a6e1f475feeb75b7cdaaa4cac

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 01:02

Target

Sora - OpenAi v1.1/__MACOSX/ext/php_mbstring.dll
Size

1.2MB
MD5

91e97c0ebbe5a7053b9396b1e376283d
SHA1

1906eae6644797e905a1f54c558e83c550440320
SHA256

6653e52f3a7d12afc5e1d5922a73d56a9d914864a1f882004e986ea210005b61
SHA512

3e4e03e4932cf3cdadbc29f0163e81ac430f94e4497f805b31cd0ab12e3975f8152347b78ab1efe1a1feb24101925e671585b8d7080316ac86f4a6d78de9e790
SSDEEP

24576:iWObDO6zJAgrbNn1XHOOBuqtzfnjEzPLmo3jK:PuDBrbNxk0Ln4PL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2984	2988	rundll32.exe	28
PID 2988 wrote to memory of 2984	2988	rundll32.exe	28
PID 2988 wrote to memory of 2984	2988	rundll32.exe	28
PID 2988 wrote to memory of 2984	2988	rundll32.exe	28
PID 2988 wrote to memory of 2984	2988	rundll32.exe	28
PID 2988 wrote to memory of 2984	2988	rundll32.exe	28
PID 2988 wrote to memory of 2984	2988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\ext\php_mbstring.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\ext\php_mbstring.dll",#1
  2⤵
  PID:2984