7213f30970c9764e1e0f85f15125f9241cf2619fb4724d322b5fe6f8ee3d9da0

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 15:30

Target

$SYSDIR/frapsvid.dll
Size

92KB
MD5

88be8fce67c977fa48e0105990779137
SHA1

f6785cb9d91f125704b69807e3bd17e18d1695c5
SHA256

9246354e999750b19f8e16314d7e64f072a705adb03dc2aa55742c03454761de
SHA512

a71dd611f7e13ef56c2f6365a5ad5a632e4351a2ac8efeeb9c6344b9348032a3dc52e2cfe9eec1db10fcb2595ce89cb86be40089eb34f6b3a9a7344cffb58b7e
SSDEEP

1536:yxOxmRqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq+9H+3mKwvmAiUj9IIyQMjH2LNkdT:yxOxwqqqqqqqqqqqqqqqqqqqqqqqqqqh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1932	2064	rundll32.exe	28
PID 2064 wrote to memory of 1932	2064	rundll32.exe	28
PID 2064 wrote to memory of 1932	2064	rundll32.exe	28
PID 2064 wrote to memory of 1932	2064	rundll32.exe	28
PID 2064 wrote to memory of 1932	2064	rundll32.exe	28
PID 2064 wrote to memory of 1932	2064	rundll32.exe	28
PID 2064 wrote to memory of 1932	2064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\frapsvid.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\frapsvid.dll,#1
  2⤵
  PID:1932