41696d0bff91e1ca5b83c99bc1528ecd893e127afb4555a9391e5313c73b51b3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/06/2024, 12:27

Target
$PLUGINSDIR/IEFunctions.dll
Size 7KB
Sample240621-pmw25stcnk
SHA256 465e81022be2df0433a6e02d427a79dc733031abc89d99746b73576a976857e3
MD5 5a3a8d916dd0071f16d217bbcfe7d047
SHA1 c2265fa5cec491706d0921e4274c674b693f326f
SHA512 8908ee2e329171d2ee430aacf7f86be565472cdb9b338786188ab37d6e6a714e5bc98552a39737ff8a5f314730c9f351aa0f1fa8207eff32289d7bccb3e05a08
SSDEEP 96:GibIzePROHQWH6hhawoA8Blnw4npQhrfgWV6R6CtqLZ:GibcXvScwoAMlnw4npkroWV6RN4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28
PID 1688 wrote to memory of 1976	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1
  2⤵
  PID:1976