4691b5820190679e577d8c7a0967e3328e1448ac8292de87b603cd9afe200364

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:28

Target

Spoofer/PresentationNative_cor3.dll
Size

923KB
MD5

2f2a11c99108bffc58bc6fff7e076f01
SHA1

c3a5cf429aacb3529762fd8362cd4e7329a13e27
SHA256

4b00ab43d9466b2bb247061338c7634b5aa85f0288fca4109a54d9aea059af6f
SHA512

7bd3047bb61fc29d065cd19a0624ed22c3ad03c8346b6875d177d77034f53b7819878a9e196b1fd04e02045c773b005fb6d7d4381d1eb4799536a3e4dc4505b5
SSDEEP

24576:T+GZIdVlIVigZtmZQnxQLfsK7mbxZRQxm7Gcs6k5kAY11VywRoD8:TBZIdVlIVidZKxaExQm7e5u11V7RoD8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2180 wrote to memory of 2040	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2040	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2040	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2040	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2040	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2040	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2040	2180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\PresentationNative_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\PresentationNative_cor3.dll,#1
2⤵
PID:2040