a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/FILEIO.dll
Size

86KB
MD5

a2fe4d84306cc533baab98d2a885be66
SHA1

b6a339b9bf62b9cfd1911bb321cd7040ccb504aa
SHA256

09143700bb9f243dc01399f5992b746c5ac41ca03d5df08c6290fc8150e02cd5
SHA512

68a5d106896b055872229a15e46b61354cded43ba9ff6347eac058e980ee5dc8d74842c17e38cf8f85d14668fa09d6f131d03abf425489330d0c59d319b98ea4
SSDEEP

768:0DCRhOO8q89Ya7ih9qsGrD1E4NpsmlWqmMA4XP3Be5hIUPJ2+d2MQaAAe:0OHOOq9Ya7u9OiwnlYMAK/BORd2M/AF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2076 wrote to memory of 2208	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2208	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2208	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2208	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2208	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2208	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2208	2076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\FILEIO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\FILEIO.dll,#1
2⤵
PID:2208