2d52ef6c7d66fed4ca81a4a0e0adfad036d24653700fd17a45366826ce0ad45a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 17:22

Target

Accelerator.dll
Size

307KB
MD5

bf6cc6604c959ae1bfe649bf18634454
SHA1

afc868af909f049c06a6dbcf2ba78dd0414b8105
SHA256

cb258957da8d6a06b876109a70c185a6097646817cafdc14c3d523f7a4f1025d
SHA512

f9f803cb5d5a0f7867b76b2f49dac2676d84d41f8c2f42a86427f265386928736bbebd4492b494e9cd1b9fe029e3f0f3b21192b8bd2a6d98309ce820dc740b51
SSDEEP

6144:l2GMn+qaIrAf4pd3DecSGUHmJYSJuXEj0j888888888888W88888888888Bf:U3+yt8SYiuc0j888888888888W88888t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1544	2276	rundll32.exe	28
PID 2276 wrote to memory of 1544	2276	rundll32.exe	28
PID 2276 wrote to memory of 1544	2276	rundll32.exe	28
PID 2276 wrote to memory of 1544	2276	rundll32.exe	28
PID 2276 wrote to memory of 1544	2276	rundll32.exe	28
PID 2276 wrote to memory of 1544	2276	rundll32.exe	28
PID 2276 wrote to memory of 1544	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
  2⤵
  PID:1544

memory/1544-0-0x0000000000280000-0x00000000002D5000-memory.dmp

Filesize
340KB

Download