590d9e8fd9be7a07b6d474cfc17085cdcdf3a2f7e84b23005e97e0a5760d2bba

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 06:09

Target

visual_viewer.dll
Size

192KB
MD5

7fa6d9f29783b9dd493bd822786bc053
SHA1

b610bd08833e1808f507033dce811974e12d96b4
SHA256

14970e018650fd3aab2918ca30aa2280c67de6b1a60581220737724194328f16
SHA512

4b3fea399bd73514f363ab7720b83c555e7f3e5040d5285a0fc41c25df9c738b87c720e1aeab112098c81496563a7b885013b83dabd5d3da075fd37683249ff2
SSDEEP

3072:edXV+YjCfGkUSK0A2SXOHqm5aFlQF9kkOV8VYhn/jgeAYqQ9/weg3HY9052TBf/P:edXBCf/A2SXOKmfFWMmpAYqQlc38052

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2272	1412	rundll32.exe	28
PID 1412 wrote to memory of 2272	1412	rundll32.exe	28
PID 1412 wrote to memory of 2272	1412	rundll32.exe	28
PID 1412 wrote to memory of 2272	1412	rundll32.exe	28
PID 1412 wrote to memory of 2272	1412	rundll32.exe	28
PID 1412 wrote to memory of 2272	1412	rundll32.exe	28
PID 1412 wrote to memory of 2272	1412	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\visual_viewer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\visual_viewer.dll,#1
  2⤵
  PID:2272