7a464be070d49cf0d53953907785917666e5ca38513a1a7a81b56edcdb7f15c8

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/07/2024, 17:10

Target
x86/ACE.dll
Size 1.1MB
Sample240702-vpnrfasfpf
SHA256 f9675304d13efaee32e6b4a3317b64231a59b684532a898d12b4e7ed88518afd
MD5 d0ae82cdf9911bec3eddda128602af04
SHA1 58e167521f2b028d03aeb6c926d34c2c969fa9c6
SHA512 c1520462a8e02ab09e2a101207e88cf6861b48c32b7c2523047251496479740a84987fb19aba4dc8610abe2c81e5f7dbc80c51b8667f4953e17dda583d27557d
SSDEEP 24576:tmGLzPLOXbuKR17zBXE+MXRHRg2yTEg863NzSxoopoo+F:v3jOyY7zB0+MXRHRg2iBrdzSqF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1924	1680	rundll32.exe	28
PID 1680 wrote to memory of 1924	1680	rundll32.exe	28
PID 1680 wrote to memory of 1924	1680	rundll32.exe	28
PID 1680 wrote to memory of 1924	1680	rundll32.exe	28
PID 1680 wrote to memory of 1924	1680	rundll32.exe	28
PID 1680 wrote to memory of 1924	1680	rundll32.exe	28
PID 1680 wrote to memory of 1924	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\ACE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\ACE.dll,#1
  2⤵
  PID:1924