c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 09:25

Target
madbasic_.dll
Size 209KB
Sample240723-ldq8raydja
SHA256 d6d5ff8e9dc6d2b195a6715280c2f1ba471048a7ce68d256040672b801fda0ea
MD5 da03ebd2a8448f53d1bd9e16fc903168
SHA1 889b4f487d8bba6af6ff6eb7f5afd74957586c49
SHA512 0ddabef35bb786e29db15c1b85ac0dca740c0e8df133f67da0ea0ac3bcb3b0ee3f055bb348a4f6f32638f03ec1ad0fb1737d6c2928cb6e6e39e91567e27fade2
SSDEEP 6144:BN/IpSQxE6qeM/k4qTl5L5e5+53WCG1C8FKFlf1:2qeM/k4qR5L5e5+53WNYH1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\madbasic_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\madbasic_.dll,#1
  2⤵
  PID:2240

memory/2240-0-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/2240-1-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/2240-2-0x0000000050120000-0x000000005030D000-memory.dmp

Download