767091a7c1294e9909cf14424ba538fb3a40569d4a1cbb86ffeed199e9745328

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 19:30

Target

ref/win-x86/libusb-1.0.dll
Size

132KB
MD5

7bbf88cd0d3a951d10fdf9528ba358ad
SHA1

93475754b183f85a67961a3932b29c749d396faa
SHA256

eda7ec675e1502f725eb325e696b3bebd943d60e10dfdf0f739fe8f9dcc2d524
SHA512

43cdf05730e9fca4e995b30352c4a507e5f8fc4ffab3a32ce953ea782481b703a6bf60bb96c054da40a00250672127407dab0cc70ac6c3f41a134ee263a0c8eb
SSDEEP

1536:VFsnZMU9Nq64MvQSJDgXruk46zgT1awkr2SaL66/13otReS4yiGaPYmK:SGU9NyMYKg6ka1krTF6lo/LiGaPYmK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2440 wrote to memory of 1852	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1852	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1852	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1852	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1852	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1852	2440	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 1852	2440	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\libusb-1.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\libusb-1.0.dll,#1
  2⤵
  PID:1852