d428e48a77074d621d8a375f6130e3d85b82097d6d0cc90b030557388bb9b313

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 07:39

Target

Accelerator.dll
Size

306KB
MD5

091f0da49c9fe3f5903fa46638017442
SHA1

2c3627308d0741f4c517fdadbd58bbb0398518ad
SHA256

34c5416f4261f76103722ee86b9dcadc7ebddb2b4ee1d49a7eca914c2b343141
SHA512

e651a615a714822e4f036ca6dc79bc6a01a023f681a825f8d35b0cdd5293f80d51eb41bf14ecfb59f49cdbd8867df8e784118e1a504eebf394ca25c7987a63bd
SSDEEP

6144:I2GMn+qaIrAf4pd3DecSGUHmJYSJuXEj0j888888888888W88888888888I:D3+yt8SYiuc0j888888888888W88888g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2948	1660	rundll32.exe	28
PID 1660 wrote to memory of 2948	1660	rundll32.exe	28
PID 1660 wrote to memory of 2948	1660	rundll32.exe	28
PID 1660 wrote to memory of 2948	1660	rundll32.exe	28
PID 1660 wrote to memory of 2948	1660	rundll32.exe	28
PID 1660 wrote to memory of 2948	1660	rundll32.exe	28
PID 1660 wrote to memory of 2948	1660	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
  2⤵
  PID:2948

memory/2948-0-0x0000000000190000-0x00000000001E5000-memory.dmp

Filesize
340KB

Download