a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/MIX32.dll
Size

141KB
MD5

251517f541f904715c627e33adf0f81d
SHA1

008b71c1ac35a0827978db40e8bb840879d22aad
SHA256

02b21ca28cedb30fa1e0f11bd924d0137ad00006c0baadcb54e5d7e37fb98788
SHA512

09ced1c92c1cdb82f48d221cfd5b1e7ca78c31eba2922817f1d8201631326a8652e744446b6c364371dd124add7132e841b7c80187f65a0bd6e9907faf7a1da0
SSDEEP

3072:peC0O+H29PZzXwvhsgTLuFEx1kPqMqa0UWxvnjMdcmzYQLahiSbrn0Bg1TPBqKi/:peC0O+H29PZzXwpsgTLu+x1kPqMqa0Un

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 2792	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 2792	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 2792	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 2792	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 2792	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 2792	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 2792	1108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\MIX32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\MIX32.dll,#1
2⤵
PID:2792