2523a3e0cb5cdb5044c7d31436f2063155c6d4f05c3903fbdfbeff18ffc5f274

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 08:43

Target

cvery.comvb9144523534524/wjl/actskin4.dll
Size

97KB
MD5

ce16a1452506807724027ecaa99885ff
SHA1

f02e39b292a554894592c4d05839778a18f610e9
SHA256

e478f33770968b9df23f0bf2161c0bcf5ae2433bdcd1dcef29fda92f716231da
SHA512

519824aa4ff31660d3249c49b081a6e7cc432ba884ffc5c5cb6f974372b4935664b5b73bd1ed004e372ea31eb264345215b122485ebcad2528526aff56195ac0
SSDEEP

1536:cGnwZ6b5HGFrVUXgekKL0+QqsT+dmt9ZooRPSjoRPS8OsVS5ocDeAc11iX7:cy5mFVUXMqo+i9yoRPSjoRPSuV4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2716	2272	rundll32.exe	30
PID 2272 wrote to memory of 2716	2272	rundll32.exe	30
PID 2272 wrote to memory of 2716	2272	rundll32.exe	30
PID 2272 wrote to memory of 2716	2272	rundll32.exe	30
PID 2272 wrote to memory of 2716	2272	rundll32.exe	30
PID 2272 wrote to memory of 2716	2272	rundll32.exe	30
PID 2272 wrote to memory of 2716	2272	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\actskin4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\actskin4.dll,#1
  2⤵
  PID:2716