b1a522cf1688c79e5148c41caa7ebf9c71f9cb0a87e3d2c3acd4a0e5f9c22705

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 16:04

Target
$TEMP/go/pidgen.dll
Size 39KB
Sample240611-thzppatalj
SHA256 888f6c10d62ba7470fb457f054769e24a35edb86a3144214113b5a6472b0332f
MD5 d6daa21229600584d00093df481c921f
SHA1 a0848216ed5ddf3945938de79c746ce7424c30aa
SHA512 d0cd6370ee5bb8daad4f07a63bb16554a723ee0959bff447b0b67c41bb3f32404d1ba2eb219679498a55ea63204584f5c2fb2ae466c3d0654fa0e118069b06fa
SSDEEP 768:WGDpZQyMVVIDR4fUB+9RtYknN5EQmlCHhrBPsx1H9xllMGCacV:WGDn4KDOMET97ax1rcV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2128	2268	rundll32.exe	28
PID 2268 wrote to memory of 2128	2268	rundll32.exe	28
PID 2268 wrote to memory of 2128	2268	rundll32.exe	28
PID 2268 wrote to memory of 2128	2268	rundll32.exe	28
PID 2268 wrote to memory of 2128	2268	rundll32.exe	28
PID 2268 wrote to memory of 2128	2268	rundll32.exe	28
PID 2268 wrote to memory of 2128	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\go\pidgen.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\go\pidgen.dll,#1
  2⤵
  PID:2128

memory/2128-0-0x0000000000230000-0x000000000023D000-memory.dmp

Download