1a060d1dabd86e25cb6aab039a0fdccd176cb033e5c7823164b97b9284e34191

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 21:56

Target

ImUtilsU.dll
Size

1.4MB
MD5

11d04f26d2fddde31baea41874db2dc9
SHA1

934492f00d56ea6a3aa2a41661529704e847c539
SHA256

01d00bbe1bb408c06417092f3e35c90d29fe4ee6a697e4e99c98c9891d852274
SHA512

4819cc1b1e924aaac97642bc0b566012547cfbac02721ab63ebdc039d88f81957d1de4089a47c645bd0f9f09de3c52f7ccdbcaa78005b2b335adc5dadc52b212
SSDEEP

24576:vEQCrQajY+S5eqyL9dj7GP4a6xKlnNYndIA1HVtFyr0Gnqb6WUU6ZljMFbDG0:YQj+S5epJl7+eenN5+HVmDqbUU6PUbDL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2328 wrote to memory of 2972	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2972	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2972	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2972	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2972	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2972	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2972	2328	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImUtilsU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImUtilsU.dll,#1
2⤵
PID:2972