a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/JPEGIMP.dll
Size

91KB
MD5

bf3b59831227155d61f35b1580a09c6d
SHA1

6cfbf657b8432960eb4429f0bedfb31f4f3fbb6c
SHA256

dd72a260a01d177b29febabb894e3e7ed9458204a2d645c1b69b17f4e9676928
SHA512

e742f4a92ba1020ddc7675d2b559c0ce5855d0073168178b1d0497b25c3a5f2a68db5d49c648dfeaa3274991ea6471d623b00ca2bbdf2996370fade04934d632
SSDEEP

1536:uTmqHlaL0TFI51YaX88CPA7t8h+gWROOdC6bIHFn35Bw6/kGUHM69Sdm4Jnpy:r8pKLJ85utPvd5bqx35ncGy9Sdm4Jw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1196 wrote to memory of 2080	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 2080	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 2080	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 2080	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 2080	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 2080	1196	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 2080	1196	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\JPEGIMP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\JPEGIMP.dll,#1
2⤵
PID:2080