0859c2df10da99ec46eb0cfb5516f0ae95ee376b0c574898bd78d6310dcd4c22

Analysis

max time kernel
26s
max time network
33s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 12:43

Target

HMC 2.2.0/PresentationFramework-SystemXml.dll
Size

8KB
MD5

160928813e7cafd92bd765bdce4c18db
SHA1

85b11c0d7469a9fc8d2c297e35665b41ee73c754
SHA256

872673e0e79265978bddeb5b5c410417d553920bd373a9976a33fa1549f4b563
SHA512

6de533acef8efd4f15a0a2155279a0143f6c86d91c39a41d7683195a868e48bd1850f750d6d6c635ad33df48da5a8bd152aa5fac29534de9b22f6340cd836380
SSDEEP

192:Yy/Rs7qoQh3vcXP+dKsY1tsbCyo+hCkPd2JCWfDW:Yo4TG3k/+StfyoMCkPd20WfDW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2152	1492	rundll32.exe	29
PID 1492 wrote to memory of 2152	1492	rundll32.exe	29
PID 1492 wrote to memory of 2152	1492	rundll32.exe	29
PID 1492 wrote to memory of 2152	1492	rundll32.exe	29
PID 1492 wrote to memory of 2152	1492	rundll32.exe	29
PID 1492 wrote to memory of 2152	1492	rundll32.exe	29
PID 1492 wrote to memory of 2152	1492	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1
  2⤵
  PID:2152