45446f6e7551da01e6b6eca54c82f5584b34fa5b71517e2f3977939dfb0e876b

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 02:07

Target

DirectWriteForwarder.dll
Size

486KB
MD5

38e9c17bd19793f435310dfbc240412e
SHA1

ff8c83af1e967be840a7e422b851b505959ba667
SHA256

6830bdea9c146e9a98df8b7f6032ba6433c5d44256c496f853b8cc813f996ba4
SHA512

5434715c91453320438c13c88c9c220c37ead423f8e9c50eab5db5eb4284eea9754e502b8f9de279c26f243bc125ab5cd228b93ec7aee2e5751ed3b64970af35
SSDEEP

6144:/A5W/+t/Ep19hHa+7PoniBtFfTR5CiH25P7TFUC/uHwPNmHqcm2:/VYof9a+DonKF2RTFU6uQQxm2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2552 wrote to memory of 2368	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2368	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2368	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2368	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2368	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2368	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2368	2552	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DirectWriteForwarder.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DirectWriteForwarder.dll,#1
  2⤵
  PID:2368