43dd818938f2a189ae43dcaffa558ad39d518aa60ac096f0cdc0f1c35677a249

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:35

Target

Icons/proto_IRC.dll
Size

16KB
MD5

b97ef1c629ea4b7aa2aad9eb1a52738f
SHA1

4e416a074355173edf8f64a0a8589f7f356b2f83
SHA256

d01519daa3da145f3e5ae1ab4b846b95d6f80bd9ea062604f8aacc590a698e0f
SHA512

32196b5da257fb681866147a278eb5da4a563db6ad5dc7e2713283a1f6e79ddadd6d68602da0696be4585c2903d2f6907a0559da991fd4e1b283fd9204a43aae
SSDEEP

192:LsTq6aQRUj33TwM3sDocjra6fW0CMxOR3XkEqtpc+Rb2Nbn3TYrxydDn:0RR8HTD3ssY3JxOt0d2gb2Vn3kNyRn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2472	2132	rundll32.exe	30
PID 2132 wrote to memory of 2472	2132	rundll32.exe	30
PID 2132 wrote to memory of 2472	2132	rundll32.exe	30
PID 2132 wrote to memory of 2472	2132	rundll32.exe	30
PID 2132 wrote to memory of 2472	2132	rundll32.exe	30
PID 2132 wrote to memory of 2472	2132	rundll32.exe	30
PID 2132 wrote to memory of 2472	2132	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Icons\proto_IRC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Icons\proto_IRC.dll,#1
  2⤵
  PID:2472