946211e49693c83968e17366601b8399c2ec6ea66beac77ca33fd575c3ab690a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 11:09

Target

x86/embeddeduiproxy.dll
Size

23KB
MD5

e220f0c25e844572467f0401e2d83ea3
SHA1

a1ebfd5d820155d47918acfee7e76f4c28ae4113
SHA256

39d761c6e320e5d76aa70c5ddd2ab74ce34882f38cef89c0c6942114c51f77ba
SHA512

1b2a52a3be2bed75754d160a21fd5915d3c2869e5eb6dee2d087cfadaefa4a21d33d088aa3fd92509ea13006c4fde5aed5b5f0a5cb8eabf01eac0b0f80de7b5b
SSDEEP

384:FHewZkvFDfr+jrjZLTtFubhLTtFubvXa/rl9qX2Ip4UBsqjdAA1m5wMvaSu7Onxt:F+wGdDm3cl3c/KrLy2Ip4tqxf1mlv2q/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1588	2928	rundll32.exe	28
PID 2928 wrote to memory of 1588	2928	rundll32.exe	28
PID 2928 wrote to memory of 1588	2928	rundll32.exe	28
PID 2928 wrote to memory of 1588	2928	rundll32.exe	28
PID 2928 wrote to memory of 1588	2928	rundll32.exe	28
PID 2928 wrote to memory of 1588	2928	rundll32.exe	28
PID 2928 wrote to memory of 1588	2928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\embeddeduiproxy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\embeddeduiproxy.dll,#1
  2⤵
  PID:1588