1b286678c8cdc68efc2c36261d6d898c456e24ce5fcc9e881423ba9402849037

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 23:25

Target

ollydbg-script-master/Armadillo/ARImpRec.dll
Size

204KB
MD5

814ca983955e019c14d3048bb4d23d41
SHA1

a3d4459f8b3a2e5d1b2c092fa2d277ddb67cec33
SHA256

20af561bd1de340076f6ab0dd677bdd1d61a0ceb239c4c6361941106cf8d4620
SHA512

b88114f92979b48f26cc3fc6eb81b566fb05e580f29e4896326187d4831487f6b57fed99ea60056b0b3ef7096f2c329fbf59db45f053df651d07f2e3ba92c360
SSDEEP

3072:SZCt5jcRQP58902q2Ajrm3/6RP8pGuZeacSQnHORFywejvoGzfaxQchTBfN4Ivj+:0JR4EoTrXCWvNzCx5hTBVzj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1928	1564	rundll32.exe	28
PID 1564 wrote to memory of 1928	1564	rundll32.exe	28
PID 1564 wrote to memory of 1928	1564	rundll32.exe	28
PID 1564 wrote to memory of 1928	1564	rundll32.exe	28
PID 1564 wrote to memory of 1928	1564	rundll32.exe	28
PID 1564 wrote to memory of 1928	1564	rundll32.exe	28
PID 1564 wrote to memory of 1928	1564	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\Armadillo\ARImpRec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\Armadillo\ARImpRec.dll,#1
  2⤵
  PID:1928