b61094c4d893c617d4884ca2da240da17fd2d92fe641fc1899d07d9d70539974

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:36

Target

CoreUIComponents.dll
Size

2.0MB
MD5

28a9062f97909b3370df3f54b6705e10
SHA1

cf29a1bcaac54a9399f977955dba42158f8fb691
SHA256

b61094c4d893c617d4884ca2da240da17fd2d92fe641fc1899d07d9d70539974
SHA512

ff93ffa4db9d38c30f6dd1d1a5f578cdba4a8df411b032bb6657c89e66ade1d41972c1d6f49a8477791eb1f781d1ae2b258d79b8714144598288ebccdec48d35
SSDEEP

24576:fKUq+1fmOol6gCVr9eRPKPQsGDa52TfVeHXP8BZgSbDFbQpBA2HIzlJFTs:N1fmgIKPQKx2/deBA2IxJFw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2756	2952	rundll32.exe	28
PID 2952 wrote to memory of 2756	2952	rundll32.exe	28
PID 2952 wrote to memory of 2756	2952	rundll32.exe	28
PID 2952 wrote to memory of 2756	2952	rundll32.exe	28
PID 2952 wrote to memory of 2756	2952	rundll32.exe	28
PID 2952 wrote to memory of 2756	2952	rundll32.exe	28
PID 2952 wrote to memory of 2756	2952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoreUIComponents.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoreUIComponents.dll,#1
  2⤵
  PID:2756