0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 05:11

Target

SDL_ttf.dll
Size

165KB
MD5

57e661eb0715dc77a60f344e9ab5d8a2
SHA1

8d46b913112bf339c0cb202c7763d02369954119
SHA256

b2750edd981056708f33e1046dafe6d45bc82eb78636ecf368de898503769f59
SHA512

af66c0ca6e546626aee97e0843abe51e659a86a7e59fa478f20943e7d39432e4121d119d6d9b2d069f9b44ba4e3b735f775e231f72e541174b50d9a238914035
SSDEEP

3072:t5ufy6aMFaNJ23Hbps9SzlvWJ3w6jCc0v7JCTYRcVQQY8bem826vfd8093N7XFJJ:tsdaMFG231seluJgTXyVQQY8g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2512 wrote to memory of 1956	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 1956	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 1956	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 1956	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 1956	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 1956	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 1956	2512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL_ttf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL_ttf.dll,#1
2⤵
PID:1956

memory/1956-0-0x00000000001E0000-0x000000000021F000-memory.dmp

Filesize
252KB

Download