ee2994270b42614eb65db99369dbe610a5ddaba06322b56c15280d1d5ec76019

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 02:07

Target

$TEMPfolder/ortmp/smime3.dll
Size

129KB
MD5

88f553be556ae62c59b3a3fbea81987e
SHA1

166abd59cdf04380b939c3d216b514cbe09735f8
SHA256

741bf85f9011be7f57df51a409b9b43b45bed0329d14cedc05d0f84e60c66006
SHA512

d27e0ea06245782960bcffd41f9afbd9a7fe3bbb43f15eddbfa083568b21cc6dd15c86686fb597a0bf05d2bb4e76332eb7f28aba82e6a3695423f1458fb924c4
SSDEEP

3072:AUOZ75SYZdOhxAhuV9yMABbSRn8suaQZOXXoYC/6I4zdSbfoMR0NOBqN:AUOZ75P6muSMmWRntuTAdNN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\smime3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\smime3.dll,#1
  2⤵
  PID:2132