134c5d1acefee78416ad78742e402a3992bf3ab31ce21a7c3bf07cf4e182ef22

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 16:11

Target

$TEMP/$_85_/InstSupp.dll
Size

365KB
MD5

8f11c131cfa10a7f4df6713a600edc4e
SHA1

f778dde4e4e07c2851787aca0d9599bacc89d112
SHA256

6b983cb710acb18c3f41fb0b0593a437f824f467adbdbcaee754bb78b7a10493
SHA512

e1a1841a3f45aca5c641440ec4ccb371d3f593d6e7b31dacf0072efcdecddc845ac54344be196404e0e8bba03330e1d02b07d3a3637c3bc1e5dc30eddd72aae8
SSDEEP

6144:oax/t+8HtpQhakvZpS6IkOrwESznfzQq7aHG/coYbioVm/Pg/Jm8ji:oaJNpJkxpLIkO0ESzn7J/GiuEPH8ji

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2928	2316	rundll32.exe	28
PID 2316 wrote to memory of 2928	2316	rundll32.exe	28
PID 2316 wrote to memory of 2928	2316	rundll32.exe	28
PID 2316 wrote to memory of 2928	2316	rundll32.exe	28
PID 2316 wrote to memory of 2928	2316	rundll32.exe	28
PID 2316 wrote to memory of 2928	2316	rundll32.exe	28
PID 2316 wrote to memory of 2928	2316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_85_\InstSupp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_85_\InstSupp.dll,#1
  2⤵
  PID:2928