ebe21adcf65530e322c179b36f545ec2c333b29ea1487bc42da9c357010e7b6f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 05:36

Target

Generated Invoice and Log sheet details/mspdbcore.dll
Size

739KB
MD5

8a1f558b8eb6cf674f186311c171d042
SHA1

9035a86b3fc5eb192b3d98e7dc551193bb5e2edf
SHA256

3193ff0b3db506c6272d21014b802f5a4e49ed7949b06c86029ac91ad01a63f1
SHA512

a59d1a1cd6ce3bb748d690ca4eb3a4ef68c2094e69c139ea9b082b0b3fb0ba05089bac59fb02d532372d2de618d369680bdfee8ce9f4404248e77d0c6b382c36
SSDEEP

12288:r+2YiTo1wE5qVGCWw/ZKpeh3ZY9Lzmz0TbSqHwR9TIKTegHBIQ:1YooyE5qVMw/cpe891TbdHwHTj/HSQ

Score

1^/10

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 1884	2404	rundll32.exe	31
PID 2404 wrote to memory of 2100	2404	rundll32.exe	32
PID 2404 wrote to memory of 2100	2404	rundll32.exe	32
PID 2404 wrote to memory of 2100	2404	rundll32.exe	32
PID 2404 wrote to memory of 2100	2404	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Generated Invoice and Log sheet details\mspdbcore.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:1884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:2100