c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/fontmanager.dll
Size 332KB
Sample240603-pypr7sgc32
SHA256 bcae3e471eb725f583705206d621995a630effe6817a5c2a8e76c78b527c8e2d
MD5 788e5827a2887a87aedbcb59ca9ea9ef
SHA1 f60cc7ee621586fa7dd94700b80613f138a805cc
SHA512 092e595e87f74762f47aec8952672be6e3b8a674712c1e3fb2b454ceb142da7171a35e440c0a04537a60234df51a2aa441448bca33894da986076cf600238d11
SSDEEP 6144:hZi3ig9n5WzCgdjLekTqxb3H9JO2IbMM40vl/EUwNF0K5eimn9AZJK:q3iK0FjLe2qxzH9JO2IbuZr0YlJK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1740	1852	rundll32.exe	28
PID 1852 wrote to memory of 1740	1852	rundll32.exe	28
PID 1852 wrote to memory of 1740	1852	rundll32.exe	28
PID 1852 wrote to memory of 1740	1852	rundll32.exe	28
PID 1852 wrote to memory of 1740	1852	rundll32.exe	28
PID 1852 wrote to memory of 1740	1852	rundll32.exe	28
PID 1852 wrote to memory of 1740	1852	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\fontmanager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\fontmanager.dll,#1
  2⤵
  PID:1740