57e90295056333b0de05689523eef17285d034a25a9a1965d789da54af854aee

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 00:17

Target
$APPDATA/Vuze Turbo Booster/packet.dll
Size 60KB
Sample240614-algtha1cpm
SHA256 0b681d867089f44fd9c25a343b94b229b3d9db65d060c6c3767535a31e3eeee4
MD5 c123eb3439ae8ab13a971bb6f0515411
SHA1 3ffa02b544b90433e816136e3bbffad0ca19735c
SHA512 99f91d83d43dd73b6737dbbbf4eebf045d9e6a3f2a690210c67f363fa734d1a60b8b306798950668f80762798f52c7c2cfb65260766bbc5aced65ef306fb7aa7
SSDEEP 768:ZPwRf6Bph61db4Ws71Ti/kZSC2pZplWsv9Q/OpKX:wZGr71TiYSCa4ilKX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2124	1936	rundll32.exe	28
PID 1936 wrote to memory of 2124	1936	rundll32.exe	28
PID 1936 wrote to memory of 2124	1936	rundll32.exe	28
PID 1936 wrote to memory of 2124	1936	rundll32.exe	28
PID 1936 wrote to memory of 2124	1936	rundll32.exe	28
PID 1936 wrote to memory of 2124	1936	rundll32.exe	28
PID 1936 wrote to memory of 2124	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Vuze Turbo Booster\packet.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Vuze Turbo Booster\packet.dll",#1
  2⤵
  PID:2124