081b2455cbf464eee43082d023137137eaf43b7a6e1f475feeb75b7cdaaa4cac

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 01:02

Target

Sora - OpenAi v1.1/__MACOSX/php5.dll
Size

6.7MB
MD5

0f9246f67611db06b9082a03e2680aba
SHA1

12d3ab77f06921aa9d7ebeda5410cc34455df7fa
SHA256

36179be42a85e363099ab57852f6fd1cd12e602e1475841ab169d13fc8955065
SHA512

d10d35febcbf0c036ae12be57cb168841e47f8f171a65b8b11ee625ced9ff0a33fcaa6467e690f8e9880bf8fdbb0f3dd77f5740453fea06ca8292dfdae86f0aa
SSDEEP

98304:shtl0ess7frbkTMxA077IafPxZA77VnKoGkK+ZW8eXJOM5xOkCJAumkDvJrKBAUp:Wrb0077IafPxZ8VBzJrKVO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2148	3052	rundll32.exe	28
PID 3052 wrote to memory of 2148	3052	rundll32.exe	28
PID 3052 wrote to memory of 2148	3052	rundll32.exe	28
PID 3052 wrote to memory of 2148	3052	rundll32.exe	28
PID 3052 wrote to memory of 2148	3052	rundll32.exe	28
PID 3052 wrote to memory of 2148	3052	rundll32.exe	28
PID 3052 wrote to memory of 2148	3052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\php5.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\php5.dll",#1
  2⤵
  PID:2148