2523a3e0cb5cdb5044c7d31436f2063155c6d4f05c3903fbdfbeff18ffc5f274

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 08:43

Target

cvery.comvb9144523534524/wjl/ColXpProgressBar/XpProgressBar.dll
Size

19KB
MD5

3988e63e05666f93dc5e8a8959f2169b
SHA1

f996498046204082d504cd7d43f6f4b0649c0bdf
SHA256

ff774c4aa831b544b68dfa00d6db25973823bd918be1dd2fbfc3a7658ec6d8ac
SHA512

01979c18bdf2b320a4b64444e16d93684eb0a5b4c1a92a5ac45db7d3b485723086a01f570085d55af7cf684feb72efbe197d7912e7eab5195f1a375c547e0e37
SSDEEP

384:eUZyBEzU08liipC+TDkiI97/0NF+8XO+c08N:eU0EzcI+TgiI9gWex

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2260	2316	rundll32.exe	30
PID 2316 wrote to memory of 2260	2316	rundll32.exe	30
PID 2316 wrote to memory of 2260	2316	rundll32.exe	30
PID 2316 wrote to memory of 2260	2316	rundll32.exe	30
PID 2316 wrote to memory of 2260	2316	rundll32.exe	30
PID 2316 wrote to memory of 2260	2316	rundll32.exe	30
PID 2316 wrote to memory of 2260	2316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1
  2⤵
  PID:2260