d2cd99f2ffcad6cc11d3798ad269c5a711ac9a9bd445e940df99b65d8b095d4b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 02:01

Target

Acrobat2Dict.dll
Size

15KB
MD5

baea06bd593b34e67bfa64ecb25ca5b3
SHA1

0702e9e89d0699bab1250e756a4ac1de55963df8
SHA256

ee7032ef0abf34e87d3225fceea2dc2381ed793ab898ab30c807e8fb929c50b4
SHA512

951b2e8b8b50ddf0218078d77bf6b3f85ff7e4d5d7914de0fd9c9679c986fd52c9462a9e6cdf1099e5c32f7037de7f3290b7a85bd05a27b0f8bdab5a51ed5094
SSDEEP

192:zVeBIHeJiIL5gxrtifxGz4Oa3Xz6Akpbk8pFf3eyowJL/8Qpkqs1IO8Lk5+ebCf/:FeQIL5gxYfOWj6LXb2YJLu1qabCZh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30
PID 2392 wrote to memory of 896	2392	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Acrobat2Dict.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Acrobat2Dict.dll,#1
  2⤵
  PID:896