a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/DmXtremePack.dll
Size

84KB
MD5

572bdc29e0c90983faede043b0a3d4cf
SHA1

502c678e3298fc953272abb924987a9b4da93571
SHA256

00a361e41ae39d6cbd49d67f9f53f9d652efd49beaaa691f7302d448833428b2
SHA512

cde7be348b03d1297c78ace69b983362d15368fa10537ed08a1b208f2c2b0b667da2ed85a1d75140b11fba817df62ac82ba7e5e198944c32deb8e592853c10e6
SSDEEP

1536:Tim3Fw3pndibtJgbPBAxnyMDiX479Bp1cguznrg2Cz9:Tim1w3ddkJgbPBpEiX479BbQrgH9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2084 wrote to memory of 2764	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2764	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2764	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2764	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2764	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2764	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2764	2084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\DmXtremePack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\DmXtremePack.dll,#1
2⤵
PID:2764