7869aefd04fc720314984ac0d887078d001baf7f8c880369dcedbaee0ede9e3f

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 22:04

Target

Setup_new/libwinpthread-1.dll
Size

77KB
MD5

1f4411c1f66c9cdf96ca9d7f9caf52d9
SHA1

ea04be653df7335483c7c8f46367d75d4ad9224e
SHA256

b5fe4d6408ef2baabdd168f4c7250900606468e9aeb24c71e0c833d3d715ae65
SHA512

8b95d0533773c5424733862cf60ed0f0d2ed5c7016b602a71dc4ce4a90ef0946de605f46c94fb0f6c3135447f60a00d3476e8b91a61e079885aa764bc1407b8a
SSDEEP

1536:NCogndcxz8C7iYx3AUwTG36Djm2uYUjslAsvONDuJluLjIGxim3Yx:Nydcaix3v363K+GNDDLjIEim3Yx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2564 wrote to memory of 2028	2564	rundll32.exe	30
PID 2564 wrote to memory of 2028	2564	rundll32.exe	30
PID 2564 wrote to memory of 2028	2564	rundll32.exe	30
PID 2564 wrote to memory of 2028	2564	rundll32.exe	30
PID 2564 wrote to memory of 2028	2564	rundll32.exe	30
PID 2564 wrote to memory of 2028	2564	rundll32.exe	30
PID 2564 wrote to memory of 2028	2564	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Setup_new\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Setup_new\libwinpthread-1.dll,#1
  2⤵
  PID:2028