2a29407a012be17087edc4de06d1c4ae96f72ae52097aaa98bc2707d7d7624c7

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 01:22

Target
$PLUGINSDIR/portable.dll
Size 24KB
Sample240612-brbecaxenc
SHA256 25e5a428e663c6b6c352e7eb313d9fd265e944e0f8f88c7406c3fc15d1ad82b6
MD5 c9397d267d0d10169c4535f6d5e06a6c
SHA1 2fc5d2e909d56042d32b3fe0a5ae39fc58d110ef
SHA512 143943d8e02392ef41c2c43641db9d1737a108defb9cd62a3ed3dce800ccbc8f5997f1d0ea4846ae675e3f2b0efbbd9cebd5c5c0022822d10a89a356983440e6
SSDEEP 48:q9aX7AL2vnYLtSFs4p3Wj4vLj4GWTQfQx2m28gF244m4y+bAghX:YaLArMpGjsjdTUt2t25m+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\portable.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\portable.dll,#1
  2⤵
  PID:2004