e223f60ac7d4de97d15b02c451531144e95b2a2caabf73ef11a05863116eac54

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:14

Target
$0/zwankysearch.dll
Size 564KB
Sample240620-etscessfmq
SHA256 d472a71268d322f9bbb476d9436f8e3f1de7544a1931e79ab2e74ca466d69fc8
MD5 50c053dde12ebd2beaef57da46b978b3
SHA1 2b50d1e332b100fb34c69ca2fc71af73a5dca37a
SHA512 6acf284544a0eafc5a7d28362ff243784668550a1a4a3160720dd8d932a7893a6802fc72c07066383e20357c9884a6274f3bbce13b8087b514837ec44ffaaf2c
SSDEEP 12288:yXOxCW8+P2a2MMcd/x8e6nEVsMGtSuPnWOjiJZQ0PC:9xo+Pj2i/x8n6sMGwy9jiJHPC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\zwankysearch.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\zwankysearch.dll,#1
  2⤵
  PID:1708

memory/1708-0-0x00000000004F0000-0x0000000000572000-memory.dmp

Download