808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 03:24 UTC

Target

TWAIN.dll
Size

117KB
MD5

ac558557a783c83c76b1c84066270e99
SHA1

aa49286fe3756241788c21afee625c8a84464181
SHA256

a48a23b3fcc7a6ea8f5f838884214a7de7822731e9704a8dfbf818159e48bd93
SHA512

4ac9ca9dcc772ad8ec58353836c839b0a14d09269c671c7ab4dfb99c5381b3f1bd52ca078b7e9a573e63223cdbb67a673faf0cf8f17cddbb5bd0a18a1ae3c843
SSDEEP

1536:4PDoKHnoXRfDlwr9dFMMvlu29Z+wCf9VAl1mn1ioBM3nekQtWWR+DJSSN5RqtF:aoKIBlwrjihx1GlU1PiQAWR+dSSN5YT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2968	2016	rundll32.exe	28
PID 2016 wrote to memory of 2968	2016	rundll32.exe	28
PID 2016 wrote to memory of 2968	2016	rundll32.exe	28
PID 2016 wrote to memory of 2968	2016	rundll32.exe	28
PID 2016 wrote to memory of 2968	2016	rundll32.exe	28
PID 2016 wrote to memory of 2968	2016	rundll32.exe	28
PID 2016 wrote to memory of 2968	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TWAIN.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TWAIN.dll,#1
  2⤵
  PID:2968