5cd4998506d4646d70b6f3a3fe058a7bb4f8e263f2af9797c0f9650b2174987f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 14:54

Target

GSDMain.dll
Size

960KB
MD5

24e279aea9fac64476b9e1faec7dbb1e
SHA1

a28b9d8305b92f843759dbf7d05ca5dfe09ff822
SHA256

63128ea80936d0830889e0deafc4b39ff58fca210a1be762b74c971630fdb29f
SHA512

56694fada9ef89cb42beae864ad2a05f7b253310cdf5b90ce843d9c1d6533950c2126a360558dc0dae793ed8bc14915ced03a64306c0bf4ae279b2433c82d46e
SSDEEP

24576:XRRIDf29xSDgRi9Rql1BxbUkwnkjiepakMBW6feRAKTt7eSZLWk9slD:BRWf2U9Rql1BxbUkwnkjiepakMBW6feo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2960	2964	rundll32.exe	28
PID 2964 wrote to memory of 2960	2964	rundll32.exe	28
PID 2964 wrote to memory of 2960	2964	rundll32.exe	28
PID 2964 wrote to memory of 2960	2964	rundll32.exe	28
PID 2964 wrote to memory of 2960	2964	rundll32.exe	28
PID 2964 wrote to memory of 2960	2964	rundll32.exe	28
PID 2964 wrote to memory of 2960	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GSDMain.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GSDMain.dll,#1
  2⤵
  PID:2960