80fcb4eaba78212dfc841e4410f7194dff9050e459533b34deebb9da00cc5241

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 19:59

Target

$TEMP/Start/DarkMagicX86.dll
Size

85KB
MD5

925844f0d6dbe57a793a5fb5f825a9b5
SHA1

5cf3e6da91485435d2b24ba03a1903e7ebd3c4f2
SHA256

1c98a3ce805ec519193acf85cc9f14dfcf3a7c99bbb1cfc6a779ae5f3f9613cd
SHA512

29227129668956c6292671469000dc561f9d7d60ae4a7cb6b2fc1cfe41660cb7aa3e94fbef7bdd8b354be57bd0febfbb16e616b83a99dd6370e52eb1673fefb8
SSDEEP

1536:z8vVieQymLp9+6IbUX5pP600uJVYhMPf7icAHd1jO0dTbL7r+xJuGeiw:4vVFhmL26I0580pVkA7hid1jOUyx8V7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2124	3020	rundll32.exe	28
PID 3020 wrote to memory of 2124	3020	rundll32.exe	28
PID 3020 wrote to memory of 2124	3020	rundll32.exe	28
PID 3020 wrote to memory of 2124	3020	rundll32.exe	28
PID 3020 wrote to memory of 2124	3020	rundll32.exe	28
PID 3020 wrote to memory of 2124	3020	rundll32.exe	28
PID 3020 wrote to memory of 2124	3020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Start\DarkMagicX86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Start\DarkMagicX86.dll,#1
  2⤵
  PID:2124