cce315b55368d418f7c32eb2cd0b479a6f3a46b00d194f727f38b10596497d2e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 12:30

Target

$COMMONFILES/Angels/IEScan.dll
Size

60KB
MD5

787864c00db5eda273e0bad7b7ca743a
SHA1

851e8451731046b90ac73ffda6953614e57079e5
SHA256

7b025ad00e154298bdf1d5dd32b57e2f454bc90f909221b08e8ed0576d5eb86e
SHA512

49154e17a35e009d0f68eb6764e06398fa485486959bda69de2639bc57c1b3014d364f4dd8da2bc9e57ac384817a30e5f44812bbd1e7aa3b6236e274ffd45eb4
SSDEEP

768:2Q0Uz/q4DHd5IytXGU1ZclADgN87Hra48fd+R0iyQpH/xL53+SeeKWr392LEUbGB:X0f4D9yYJlDgMgfdtyt/P+Cj924QGB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28
PID 2976 wrote to memory of 2980	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\IEScan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\IEScan.dll,#1
  2⤵
  PID:2980