a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/JS32.dll
Size

376KB
MD5

b7befd637d9a023694a4f7e6dab991b4
SHA1

a1b4a02fcbb8d8f5b6dceea5e74ecd4ef49057f6
SHA256

3b1d09bd6678190b0416941d36f97ba668039aac3bcb16bddc13e91f6773f488
SHA512

9d6deb8b7c34ec0e7280933d2464988244433edc6ef73807af4c84dba5daf401ee381be249aa81eb813929577e14dff04accdb0c39dd47f92f4b7c589dfc4f81
SSDEEP

6144:i02UebJBdzF+wKsfoTvuTRJ5hcVFCFM+SlXT7V926zGp2qynv4dOiR6UFV//Tne/:H2Ueb3dzIqvbQFmwDR9owqynQdyUFV3v

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1968 wrote to memory of 2220	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 2220	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 2220	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 2220	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 2220	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 2220	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 2220	1968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\JS32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\JS32.dll,#1
2⤵
PID:2220