6d6611463a02ae95421da86ea2be11fbeb260fddfdedb20be9561616ff33ced5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 00:50

Target

$TEMP/vidxcore.dll
Size

556KB
MD5

f0394f22ec1aebe4fc58dabf8165b65d
SHA1

336c8ce70bc6684299ea79409935ac0bd8e6204f
SHA256

0c569c72443dc1e6f17f5a137abd6443d7523a56da69581a29a10c2c869a5b04
SHA512

26b434e68ae2703d3005b82732983648f8b38cb2cfd865cee099e97bc4c5b0cb918f88e76d2a70204bb780bb9048901d436c76011f73465585394d4283e25f25
SSDEEP

12288:SQoaC6oaC4kLyb/q0sGqV7xZy+X4BOoZbTbKh64YSYf1UcRjDr+TLqF9lscGQKcB:SGkLyb/q0sGqV7xZyJOoZbTbKh6PSYfP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30
PID 1928 wrote to memory of 1732	1928	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\vidxcore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\vidxcore.dll,#1
  2⤵
  PID:1732