2da7c186708ff1fcf363a35a8d776e0cd3ffe4efe07f203d1a874d1ec4df8bea

Analysis

max time kernel
1s
max time network
4s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 13:24

Target

DotNetAobScanMemory.dll
Size

13KB
MD5

0f18d4f8323041b82363d2f4ec020957
SHA1

bc77e35fa2b2af0669e9336543412d62798b64fc
SHA256

2da7c186708ff1fcf363a35a8d776e0cd3ffe4efe07f203d1a874d1ec4df8bea
SHA512

12a5b22722a8ae8db5c91a3b5ef54d708cd8f67f7a75940fd9a9376e573a1675915fcb94cdb6249cdacc027f2a3c376a559e922fe6c0c6649c55dd1cf4e87889
SSDEEP

192:GIPj9gBEoRbDzWu62MD4Bm2khzfTpZaBz8RjKPnueyF2Yywhdz+:Gk4b/WuuRzfTpZYz6MueyF2YThdz+

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2488	2244	rundll32.exe	28
PID 2244 wrote to memory of 2488	2244	rundll32.exe	28
PID 2244 wrote to memory of 2488	2244	rundll32.exe	28
PID 2244 wrote to memory of 2488	2244	rundll32.exe	28
PID 2244 wrote to memory of 2488	2244	rundll32.exe	28
PID 2244 wrote to memory of 2488	2244	rundll32.exe	28
PID 2244 wrote to memory of 2488	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DotNetAobScanMemory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DotNetAobScanMemory.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2488