081b2455cbf464eee43082d023137137eaf43b7a6e1f475feeb75b7cdaaa4cac

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 01:02

Target

Sora - OpenAi v1.1/__MACOSX/ext/php_bz2.dll
Size

64KB
MD5

2e83d3a008f9d9bf6c6785d4feba5c75
SHA1

cd634271c56ff3b6c4c141adadb724a581378410
SHA256

d1457076b72d629f0af7e98cd6fe5be4fb0b18fb9c15675f2995b4c5e88a8106
SHA512

09fd9dba3e625dc38ec4587478988252a2ad1916f395a6d84ade09ea1a5f6c2b1353f9cd80455c22d9a0a30285a197801b3dca29664dce43e125ede9f8f379a8
SSDEEP

1536:Y+cozxhzmyk0iNGsyYOUagW8CoekqwM3B34g/YocIoq3jSc0GGsSXif5a24ijyB1:YRoTzmykmf1d+/5s+xuv8Tfao1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2524	2256	rundll32.exe	28
PID 2256 wrote to memory of 2524	2256	rundll32.exe	28
PID 2256 wrote to memory of 2524	2256	rundll32.exe	28
PID 2256 wrote to memory of 2524	2256	rundll32.exe	28
PID 2256 wrote to memory of 2524	2256	rundll32.exe	28
PID 2256 wrote to memory of 2524	2256	rundll32.exe	28
PID 2256 wrote to memory of 2524	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\ext\php_bz2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\ext\php_bz2.dll",#1
  2⤵
  PID:2524