1e3fcd966e2d0b63e5a89dc82788da8225c85926dfdfd16c6712aea5b6a0ab28

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 10:39

Target
SearchCommon.dll
Size 200KB
Sample240529-mqe7pace72
SHA256 38d90eba406c9148ebd7585820caff53e1c39e62a2e989937ce2efe67661b14b
MD5 17d1070d5ce79f3802a7baab2694f8d8
SHA1 2f64823daccd1e6f8b51ec9ff04652eaee13f976
SHA512 997e412f891d134f1826b9c9ba5d4233f4c89da0ca5ebd1cb9a5484e9eba374336ab8783d4610c75d9346c61d7f5d305b7619b1e5f651aa298348f4e707f9e84
SSDEEP 3072:DIPBhOo4PbOIXA0HRlxrl8NaPwb9dv+fLJaAY7eL8LLSz2xr830I:spso4PyIXzENaPw5doL8AYqL8LLKwa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1920	2020	rundll32.exe	28
PID 2020 wrote to memory of 1920	2020	rundll32.exe	28
PID 2020 wrote to memory of 1920	2020	rundll32.exe	28
PID 2020 wrote to memory of 1920	2020	rundll32.exe	28
PID 2020 wrote to memory of 1920	2020	rundll32.exe	28
PID 2020 wrote to memory of 1920	2020	rundll32.exe	28
PID 2020 wrote to memory of 1920	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SearchCommon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SearchCommon.dll,#1
  2⤵
  PID:1920