30e07e1ffb8283f4c30c9bd643e759cf8246bee8e3bfa4de8ea30beac532a68d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 14:52

Target

$TEMP/upholder.dll
Size

52KB
MD5

de0f2c4a5b7c7974f19f48b08b3d55d7
SHA1

fb4eea0fa23f0dffa17a141dd9a66e919a79d6c4
SHA256

ae257e13507e2980446867e3b5cfb9a5c57c2d09c24079d59667938e82c204b7
SHA512

812ad695df0188565f31e3db646ac7a41db41320bc3b03ea504dba8f027018661cc9fd47a38833df28e3db1bcfa45cf2b244c9231bf6bca6f01ddd81ff578c6e
SSDEEP

384:dNGrfGDudTR3VFKmlkYtlosjEfXyyoSwWa3C9svaAU+k9SVItAEVN8aUYwZS7PrX:mrD9RHHbMyuwdC9s7U+kJAEVN8azX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2012	2256	rundll32.exe	28
PID 2256 wrote to memory of 2012	2256	rundll32.exe	28
PID 2256 wrote to memory of 2012	2256	rundll32.exe	28
PID 2256 wrote to memory of 2012	2256	rundll32.exe	28
PID 2256 wrote to memory of 2012	2256	rundll32.exe	28
PID 2256 wrote to memory of 2012	2256	rundll32.exe	28
PID 2256 wrote to memory of 2012	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\upholder.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\upholder.dll,#1
  2⤵
  PID:2012