a4b64722382a67b8b540590ea4e993cee5e7e60b46f46778145d88da7369c7bb

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 17:07

Target

DiscordBoostTool v1.35.0/System.Windows.Controls.Ribbon.dll
Size

717KB
MD5

c938bb2a9537df587d9a4ce01de447b9
SHA1

8aee2b2e1c7c6786817a5136d011f8427ac9b92e
SHA256

c3fd046e992f96a0f4b729a6864d07f2320dc2f87fb34033874429c1f03b6931
SHA512

70eb8ee86a99f25dc9a35bad85e1dcb82dd16babbea6f2a9e540687caa96de3ccbd1205117820802853b3aa922a302183df8ec9c2cd459a4d5c111958de34e3b
SSDEEP

12288:CDZDWzv+aVPZDpPBi87JBIgu7PO447irbrM+murmje0Prjk3rNr0kzqA7+pHlj99:OmUzpXlzEOIF6HX6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28
PID 2112 wrote to memory of 2052	2112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DiscordBoostTool v1.35.0\System.Windows.Controls.Ribbon.dll",#1
  2⤵
  PID:2052