5318739a0a7ac64d992edf27091adad9610a821c92f4a92793543b214d96a308

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 13:23

Target

Accelerator.dll
Size

306KB
MD5

1c639c9f01f04c2c4a576e718c12eaf6
SHA1

79adbb97540ffe3123d95a52843894b4e866bd27
SHA256

4894790776e23b49b317a0efd243aae79d41f6f678a8167201a3e5ef98f6bd71
SHA512

d88f3a686623b3c06d7834d1dc8d5543a219379750634f254434069e69a18c3977183ae39341a3284bae325f53992a586ccd3a4462e99cd4302131fd431f48b2
SSDEEP

6144:Q2GMn+qaIrAf4pd3DecSGUHmJYSJuXEj0j888888888888W88888888888k4Q:b3+yt8SYiuc0j888888888888W88888m

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2056	1236	rundll32.exe	28
PID 1236 wrote to memory of 2056	1236	rundll32.exe	28
PID 1236 wrote to memory of 2056	1236	rundll32.exe	28
PID 1236 wrote to memory of 2056	1236	rundll32.exe	28
PID 1236 wrote to memory of 2056	1236	rundll32.exe	28
PID 1236 wrote to memory of 2056	1236	rundll32.exe	28
PID 1236 wrote to memory of 2056	1236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
  2⤵
  PID:2056

memory/2056-0-0x00000000006D0000-0x0000000000725000-memory.dmp

Filesize
340KB

Download