808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 03:24

Target

Prndriver.dll
Size

60KB
MD5

2a39233b1b7851eb9ef49c8447456279
SHA1

8350ca2a0cc94366f6479a33b6cbf7e11ac62605
SHA256

9511bbfb29ee7327bfae810a66d8c042e5f3a5c2826a3339cf80b25e4006f0b0
SHA512

6392051e00baa155bee270457e6d043e11e5a6174b9310ea04bb93bb2943ceffe14c8a2bac9f7ad94f5179b27beaf025c37de03cab6a9822fb27aafd49ac3f69
SSDEEP

768:Hpg/waa7VNI7gvrqvXD8+T3pwh9XwYroZPK6NdO7yiB9618VtAFX2ldk9KPt7I:BT74Erqr8+T3pU53oZK2CyQldk1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2560	2720	rundll32.exe	28
PID 2720 wrote to memory of 2560	2720	rundll32.exe	28
PID 2720 wrote to memory of 2560	2720	rundll32.exe	28
PID 2720 wrote to memory of 2560	2720	rundll32.exe	28
PID 2720 wrote to memory of 2560	2720	rundll32.exe	28
PID 2720 wrote to memory of 2560	2720	rundll32.exe	28
PID 2720 wrote to memory of 2560	2720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Prndriver.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Prndriver.dll,#1
  2⤵
  PID:2560