1743c09774c8aa85ea6463bf48def681e4ccf13660620e7378ecd9df6c33169b

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 16:37

Target

Fish-v327-0221/pdflib.dll
Size

3.0MB
MD5

16388e5ef07daf3c4e5349ec150d89e8
SHA1

17b067db358bbb3c9a8abd147f4022e5f7c675c5
SHA256

e8bfcb004671292bff487e9d7fc418c247cf94193c03ec01e41bbc485aea0f22
SHA512

c9fe68fc6ee2968d6da4a1a879e7e0609506dbf2e3e1417d015cac47215dbcf2b1a5dd1299c609aabc2c4a509494cbef552b4edb8327e19277b259d89cf4458b
SSDEEP

49152:UpD7JBpjcpJ/hZ1WphyWy2zccqgPTF97irQE0kUjzDTjzDTjzDqEixp9Q5ht7/Xp:UpD7JBpjeJ/ahw2KgBKputKQ6/i

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3024	2324	rundll32.exe	28
PID 2324 wrote to memory of 3024	2324	rundll32.exe	28
PID 2324 wrote to memory of 3024	2324	rundll32.exe	28
PID 2324 wrote to memory of 3024	2324	rundll32.exe	28
PID 2324 wrote to memory of 3024	2324	rundll32.exe	28
PID 2324 wrote to memory of 3024	2324	rundll32.exe	28
PID 2324 wrote to memory of 3024	2324	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\pdflib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\pdflib.dll,#1
  2⤵
  PID:3024