9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:43

Target

RecoveryPhoto.dll
Size

499KB
MD5

b0fffb87a1bd99e577a641b8fff9bfa3
SHA1

1617564505eeffca9bbcc65e957bef8b17211f11
SHA256

6da7333d333a1b9ce3edc3856ccca77909319eb90ce6e69f36a2a62d409e2dd6
SHA512

463f773a1cf380c5c37b2ade2912ae20483cb26f974d7bfb6b54938117356c83f3fba717e05117a31f2ec19d7b4ea872d9f9ac82809aa2354e479f78ac7d4e76
SSDEEP

12288:L6Kv0ihp+FDgzWxr8UfbHBLEOrKiEhv7evvpJII/Zq:phhp4DgCOH0vvpJQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2164 wrote to memory of 2172	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2172	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2172	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2172	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2172	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2172	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2172	2164	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RecoveryPhoto.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RecoveryPhoto.dll,#1
2⤵
PID:2172

memory/2172-0-0x0000000074A50000-0x0000000074AFF000-memory.dmp

Filesize
700KB

Download
memory/2172-1-0x00000000749A0000-0x0000000074A4F000-memory.dmp

Filesize
700KB

Download
memory/2172-3-0x0000000074A50000-0x0000000074AFF000-memory.dmp

Filesize
700KB

Download
memory/2172-2-0x0000000074A50000-0x0000000074A63000-memory.dmp

Filesize
76KB

Download
memory/2172-4-0x0000000074A50000-0x0000000074AFF000-memory.dmp

Filesize
700KB

Download