0859c2df10da99ec46eb0cfb5516f0ae95ee376b0c574898bd78d6310dcd4c22

Analysis

max time kernel
20s
max time network
40s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 12:43

Target

HMC 2.2.0/PresentationFramework-SystemData.dll
Size

8KB
MD5

dca6f1b8644df5d0890a7dbc6411e86c
SHA1

27066bf658df2d398aad6003ae8496dcf015a4d5
SHA256

48883bd04158c2456ea1be831b559b594fb86199c0d9618e7c3fde45a986ab26
SHA512

046020ad671d37935eb674988186eb6a8a28b093887f572a4604781be3f8fc6d9df96a00580f352789bdb7ea0f8ebaf6ee3cf13c6be5118bd1df290a3487742a
SSDEEP

192:cmBvnnwQh8N/UH6AKwBz1o5fDzupoiuhuWHsWYSW:cmVnn98N/Y6m3o5PPiu0WHsWYSW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 840	2484	rundll32.exe	29
PID 2484 wrote to memory of 840	2484	rundll32.exe	29
PID 2484 wrote to memory of 840	2484	rundll32.exe	29
PID 2484 wrote to memory of 840	2484	rundll32.exe	29
PID 2484 wrote to memory of 840	2484	rundll32.exe	29
PID 2484 wrote to memory of 840	2484	rundll32.exe	29
PID 2484 wrote to memory of 840	2484	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1
  2⤵
  PID:840