896fca5100c8a8c0b84908249cafa259654cf5eaf8191fa5da65d57b7b727dae

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 22:13

Target
$_2_/smoi32.dll
Size 401KB
Sample240516-145amaba78
SHA256 dd4b0dca1c87581cbcd2df4c6a93d6ee73fca8d1f98f0df471d3ab0cf21badd8
MD5 5d4097a4ffb42d5013be4c351ba258a4
SHA1 58a35517dd12b16bd125a3424b04a658dc33d41e
SHA512 ad06befbc13612d2c17e60170e8e76e47de9d032d7b480c0b63b9e39f4fbadcb5402f83e01e93a614c1c9986bbfe67be794d586afe993ae220e40dca34c0b119
SSDEEP 6144:/Xo/c1CCF2/CuCzZBM3CcCH9bN05PLTCtZzCOo0ClIUOtoq1/Zc7fap:/Y/cjFUiFB9LH9bu5PLWtVCOXAIVefap
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1988	1968	rundll32.exe	28
PID 1968 wrote to memory of 1988	1968	rundll32.exe	28
PID 1968 wrote to memory of 1988	1968	rundll32.exe	28
PID 1968 wrote to memory of 1988	1968	rundll32.exe	28
PID 1968 wrote to memory of 1988	1968	rundll32.exe	28
PID 1968 wrote to memory of 1988	1968	rundll32.exe	28
PID 1968 wrote to memory of 1988	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\smoi32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\smoi32.dll,#1
  2⤵
  PID:1988