229cbbac4a8000069d5ea52b0a864345b2e0a624f152f7f0472b942d2f269e29

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 20:26

Target

PvZ_Tools_v2.7.5/imageformats/qgif.dll
Size

24KB
MD5

cdf8fbded378deb5cbcac46c1304c803
SHA1

af160aa7b45c62eab1f4c2e0252cbb341e6d6004
SHA256

e7654a0810ea25c90eb74200bd68713dc713022d52e82789fa989000aaec77a8
SHA512

367a5ffa0a3cc7d0f73726750962e956087b1eb7f672db461039f1282dfc352a553526c7299d94dd8b94126a76c5f119de16f35c8ddc0e715a355c7366e917a0
SSDEEP

384:Vfghkmf8Eami5sMY2WKbLEWEwfue8+Y9JW8//90LGg9K83Vwm5qHqs5XL+:6hyudh2XEWNuIkM8//GLGUK2hoHqsFC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\imageformats\qgif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\imageformats\qgif.dll,#1
  2⤵
  PID:1872