654eebb38506e36b159f0dda7b316e2b726548145a179cec49b32bb030d5aba8

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 10:32

Target

$PLUGINSDIR/g/gcapi_dll.dll
Size

348KB
MD5

2973af8515effd0a3bfc7a43b03b3fcc
SHA1

4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee
SHA256

d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
SHA512

b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e
SSDEEP

6144:O3RIclFikwwYUP5SvL8z6uNMw4n8kUddV6F8Q4cfRUWj/aNTcES:O36SwwviL8VgnaddV6F8Q4cZBzES

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2196	1108	rundll32.exe	28
PID 1108 wrote to memory of 2196	1108	rundll32.exe	28
PID 1108 wrote to memory of 2196	1108	rundll32.exe	28
PID 1108 wrote to memory of 2196	1108	rundll32.exe	28
PID 1108 wrote to memory of 2196	1108	rundll32.exe	28
PID 1108 wrote to memory of 2196	1108	rundll32.exe	28
PID 1108 wrote to memory of 2196	1108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcapi_dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\gcapi_dll.dll,#1
  2⤵
  PID:2196