9a1fbf837e9e350ac567457bdaa0ada6cd3aeb441433a298f4d2aea51b359842

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 11:32

Target

Accelerator.dll
Size

306KB
MD5

eeaea8bccc2b1b0ac05f854986c40e17
SHA1

499013f38a367a09dc749ea67b86016825905243
SHA256

6dd5e176f5615cf498a7c7be6d5ea76acfdb7e09645f6362381db40f9fc5cd8d
SHA512

a9267dceba0b060ec8662b2b9f3756eae2b7d45bf97cef7bf922e2990ba30e156944a27595356fe456f19a6eaebf0a7c115926b5d6ebff085a403e4ae8b19268
SSDEEP

6144:E2GMn+qaIrAf4pd3DecSGUHmJYSJuXEj0j888888888888W88888888888S:X3+yt8SYiuc0j888888888888W88888K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2732	2932	rundll32.exe	28
PID 2932 wrote to memory of 2732	2932	rundll32.exe	28
PID 2932 wrote to memory of 2732	2932	rundll32.exe	28
PID 2932 wrote to memory of 2732	2932	rundll32.exe	28
PID 2932 wrote to memory of 2732	2932	rundll32.exe	28
PID 2932 wrote to memory of 2732	2932	rundll32.exe	28
PID 2932 wrote to memory of 2732	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
  2⤵
  PID:2732