15b2fa0131427a7fbffe42ce83f36357661772faa0381e6ab8ef21a81c6380aa

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 01:02

Target
ImLookExU.dll
Size 262KB
Sample240624-bd5q2avgrj
SHA256 0e469f31a8399483862231a0fe5b78bf90a7df4ac5c0470ae79adc33e4a42d10
MD5 c3d6a629966b2de0ac954c0c75847f59
SHA1 8109256492cb3a2a38a6587b7e1145c58e078769
SHA512 c80f718baa86aa05a566b8b5f8087a9f32703ef8f00ded809e0a2d74e94604b4b524989d953e26b9752e02fe2601ebe6527ef03384f6368ff6e5dca289a857e0
SSDEEP 6144:9X6yu38mY4o8xnZSYDI7jlFl4oYVFl4OgqAIwMr5s:9X6yhmY4pZSYkvl4/NwU5s
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3048	2768	rundll32.exe	28
PID 2768 wrote to memory of 3048	2768	rundll32.exe	28
PID 2768 wrote to memory of 3048	2768	rundll32.exe	28
PID 2768 wrote to memory of 3048	2768	rundll32.exe	28
PID 2768 wrote to memory of 3048	2768	rundll32.exe	28
PID 2768 wrote to memory of 3048	2768	rundll32.exe	28
PID 2768 wrote to memory of 3048	2768	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImLookExU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImLookExU.dll,#1
  2⤵
  PID:3048

memory/3048-1-0x00000000002D0000-0x00000000002E0000-memory.dmp

Download

memory/3048-2-0x0000000000430000-0x00000000004BE000-memory.dmp

Download