bb6b7ebf49d7bb71b60768215b64e7883a8995dd9f145155f3f012874c226ae4

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 15:53

Target

OfflineExplorerEnterprise/Offline Explorer Enterprise/mfile.dll
Size

140KB
MD5

5bb8d0e82e86c9109e6e65a5c292e6ed
SHA1

7892551993f8f1acee6b33e27b157af24dc5ab50
SHA256

62c0fbb7d57b37f41a962afa3273b03a3fa06d564e897422e9355f1e9d1393f7
SHA512

a1333f2080363f84e79aad7f20f1283a58f1283ea3b9779c2dd495e7b3617dc31b6d61bae3429a09695baf8578b8c57748026184111a7866450f37044dc615e2
SSDEEP

3072:AcUn1hDcNbheRYgw0K6Ag0FuHaQchKFE4:AcUn1hDOQYgwn6AO6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2876 wrote to memory of 2904	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 2904	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 2904	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 2904	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 2904	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 2904	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 2904	2876	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\mfile.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\mfile.dll",#1
2⤵
PID:2904

memory/2904-2-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/2904-1-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/2904-0-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download