91179c199ca069ef07cb1939aa20cc1ee3c91b4528402a6e3df424da2982b5ca

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 08:10

Target

$TEMP/luciferase.dll
Size

92KB
MD5

696e0a3df2927dde205b3d1894677e1e
SHA1

b10d49e4c2809e4ea9f814fd6a0a311dad62fbe8
SHA256

936babd677d69c25715d1ee19c66c18d33ff439a329c5476d59af2d54ba79bd2
SHA512

e688abb18745843b2ee018eccfc3de0fc58eb3df39a993a2f825725739862b93950ca2f164f0734e72d64b64f94720746eff4bb6d2c8cc81eb91abeacacc63d9
SSDEEP

768:/JNGCURaXC8mbKyv7oAk3pfd7fIWmr/ph6KWzmgZh0HA+711t+c4qvOZNIC:XGznoAafd7gWc/pazvqRntKZNI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2088 wrote to memory of 1780	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1780	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1780	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1780	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1780	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1780	2088	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1780	2088	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\luciferase.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\luciferase.dll,#1
  2⤵
  PID:1780