639cd52c49750fcb0d1828817c5f63fc82965cc830d2ebf09c9b265c6255e5fb

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 17:31

Target

ProxySettings.dll
Size

124KB
MD5

6c318794e02063be7b11e0dc89ade90e
SHA1

39bc8815c3d8b62a76b279d552d623d72a6f152f
SHA256

eb011527b8946dc5a9eeba1aa2e9caca49fa8891125fb164c62d18e46adcea90
SHA512

ed3d3f02c2c00b4176914e5419f40d3b7e7d3ef9ce4e9e0155fe241e2c5669563201be54cabd34432e12c7f591194d22de0a03b3644f7830b7c477cb1238a87e
SSDEEP

1536:xlkIZ9y9YNmBikKNdYsCCIUoGzYaKZ/uYNSKObPqbwcJLFlwDy2ThV+fXyg3sEJK:taH7roYN5Ob+ws6yIV+fXyg3z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProxySettings.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProxySettings.dll,#1
  2⤵
  PID:2352