1ea585df6f645b042a45ed68110886bc83434e7d5415d194ba7cc7902f3f025d

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 08:51

Target

$COMMONFILES/Angels/Scan.dll
Size

1.1MB
MD5

2af0fae7be350e43a1edd7f2035fb683
SHA1

d1d989838c011da7c9c05023a9c3cca62ba9c6be
SHA256

f27ac14c430bf9f5e16bef3fc7c68a250e8b1f5ff2c9198dd7d8d909a0bafc60
SHA512

654d29ca12a03755f5897079962170fc3e35cce5da1150770789f4101c090126da032e8b124f642842844193dfc3758b93358c7f490bbdda5bcf47f70bfd97ba
SSDEEP

24576:TgcIwdCFEXGwz6Ff78H8KZ7SI7ErlB6azPTkkkkkkkkkkkkkkUkkkkkkkkkkkkk+:TgcIwi5nQ24Erer

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\Scan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\Scan.dll,#1
  2⤵
  PID:2128