a800e519e6989f9500ef24e47cdafe7e9c3aad6f0e808799ca5e86d6c0945a43

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 08:51

Target

$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/RavenBleuSAHook.dll
Size

140KB
MD5

2cef6cc7b42725191689e9b7ecd69cf3
SHA1

09047798f121493295dbf9b1c2e51ab95fc52954
SHA256

34cbaf88ee8bc9d8babf8126016aa78ff35a2cfb637269ddcd66ffd91a39eabf
SHA512

6e8dcd20be46043ac7a2c5a07564c4116496aa471d0efc45499b34199f83853b7446d2489dcd73c7a41d182e0f1ad5cea6fd3726e66e2481a7a1a41380c5f9e9
SSDEEP

3072:/dhC5CQk9kEGpfWGCkjiXptD3brxNXlvkH8htRFsmn:Fh4Cl9tG1bpYtTb1N5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2112	2412	rundll32.exe	30
PID 2412 wrote to memory of 2112	2412	rundll32.exe	30
PID 2412 wrote to memory of 2112	2412	rundll32.exe	30
PID 2412 wrote to memory of 2112	2412	rundll32.exe	30
PID 2412 wrote to memory of 2112	2412	rundll32.exe	30
PID 2412 wrote to memory of 2112	2412	rundll32.exe	30
PID 2412 wrote to memory of 2112	2412	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\RavenBleuSAHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\RavenBleuSAHook.dll,#1
  2⤵
  PID:2112