ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 15:35

Target

bin/nspr4.dll
Size

155KB
MD5

bd0e897dbc2dcc0cf1287ffd7c734cf0
SHA1

5c9c6c6082127d106520ff2e88d4cd4b665d134f
SHA256

2d2096447b366d6640f2670edb474ab208d8d85b5650db5e80cc985d1189f911
SHA512

db21b151b9877c9b5a5dc2eda3afa6a75a827ce1f340032427b7de1d9f9803767aecc582862b58885f456c78fc75ee529581089b725975600e45c6af785280a9
SSDEEP

3072:5XEjwQq1VzTiey++hdm0mCeZrkAhniYUwl5VFTF0Rda914+2FTTf4oLkPEb:dEMfieU8A2ijMTF0RdE14P5LkP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2544	2372	rundll32.exe	28
PID 2372 wrote to memory of 2544	2372	rundll32.exe	28
PID 2372 wrote to memory of 2544	2372	rundll32.exe	28
PID 2372 wrote to memory of 2544	2372	rundll32.exe	28
PID 2372 wrote to memory of 2544	2372	rundll32.exe	28
PID 2372 wrote to memory of 2544	2372	rundll32.exe	28
PID 2372 wrote to memory of 2544	2372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nspr4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nspr4.dll,#1
  2⤵
  PID:2544