1ba98affea9e32b73e7d31dbdb580928ce63367f253d952508acb255b793ad94

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 18:57

Target

$COMMONFILES/Angels/IEsafe.dll
Size

517KB
MD5

7335e548d8e41717465ace731f72f1c7
SHA1

b468019912f943369210b195cd60116a773894ee
SHA256

ac71d821f8616022f462db7cf3b4dda551bcbd6865c05f1795454ebb956d0e43
SHA512

930a17548fcc75de600bb798ffa03944640e35dcddc3b61b22d725b36afd7d18590feb1193838a7e3b1ee5395ad81e6afe6d3698da821549be3c3ced4694830b
SSDEEP

12288:IfpD/QT3YycROwCH7JrNxfhcfVuOfkY0Kqpx/25tbyoVmmjyHe4TBu1pJLRy:6sPrm++ou1p6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1992	3068	rundll32.exe	28
PID 3068 wrote to memory of 1992	3068	rundll32.exe	28
PID 3068 wrote to memory of 1992	3068	rundll32.exe	28
PID 3068 wrote to memory of 1992	3068	rundll32.exe	28
PID 3068 wrote to memory of 1992	3068	rundll32.exe	28
PID 3068 wrote to memory of 1992	3068	rundll32.exe	28
PID 3068 wrote to memory of 1992	3068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\IEsafe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\IEsafe.dll,#1
  2⤵
  PID:1992