37b3fa9a0fad103ba7311948f3eff98779253409556488638ffe057e435d812d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 21:13

Target

$TEMP/public_ftp/VSMigrateUI.dll
Size

15KB
MD5

8a5d7b38d9bdd2d1c69a0e93147406fc
SHA1

543d2409257eeba9387bc281f100adf5dbc77966
SHA256

6a0062f006f1eb13c641a841b7dabf7dbdc810f946bffd9282f72141a72d3bd3
SHA512

e3b3dcb12986995cb943a449ae80acf48ba6abe7e35673337595f919f9bc821313d35c4708657461c152cf36b1aa29c9ee32b7c9b8332da9b90b4ed2297e9150
SSDEEP

192:lZxn3fUnucJHN3Xz6vrk9l4cWLAwYWep+/WWqfkIL/CldolMvMjGwPgMvws+ebMg:xP6D6ml4cWLAwNes/WjbLCcY+wCbsOF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2120 wrote to memory of 1352	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 1352	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 1352	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 1352	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 1352	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 1352	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 1352	2120	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\public_ftp\VSMigrateUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\public_ftp\VSMigrateUI.dll,#1
2⤵
PID:1352