b16b2bb2cf65357f42f046e187a668cc9ddaf564f0d14e766b55404be97c9686

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 04:52

Target

resources/extraResources/WinDivert.dll
Size

42KB
MD5

1cb0efd60883b5637b31bf46c34ae199
SHA1

b91de8d5f072f8c6aabd029d96568effdd5662d9
SHA256

625ffdd95bfabff32d0e8a95beabcd303c01c8bba73b90402d4e84d6e15dd8e5
SHA512

68c7c257b8cd28011f4b9af09b1e4c7b3d69c6f1457ca6f68fe114fcb382e470b87b9c12ca5d6d4aedd27a103a35fac9093c08b288867cceb9621a60ac70a6f7
SSDEEP

768:/BD4bCa+EfZ9+EwleNwYLWKkR9c5s1R2wdRt7JtXwxwprTKkimOyd:/BD4bCofZ8VYwYyKkR9c542wdRQ0TKkV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 1472	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1472	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1472	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1472	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1472	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1472	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1472	2040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\WinDivert.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\WinDivert.dll,#1
2⤵
PID:1472