95a8e22f4586b962c8bbe268f28b9561ecfafc06bee75f3571ced253d66d5531

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 16:58

Target

fbclient.dll
Size

3.6MB
MD5

b8e93b77d06fe8acc4438bb88f9ae231
SHA1

b7b9116db1aae43a58bb8c0f3a002977e10bf834
SHA256

688caa8cecbca2a07baded86c567ec844b39aa3dcd50c136ab8ac4bbee8e99f1
SHA512

8e3ccb43d67ec90165b44cf5c14db73394ff8d1ac19548a1bc3fe807d361f0a7b5a8c9bb8ca34545a770795fd5f0a07c373039dbc3c6e15fd385eca263e91d23
SSDEEP

24576:CmvmNB5rZMCemDjVHBsyEJAYr3RKFgNtXy26oPjdarC/168Cs6RX1HQ46sWJvaKp:CmgdnHTuj0+qHPv203ymNsqYv3jnB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1544 wrote to memory of 1696	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1696	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1696	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1696	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1696	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1696	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1696	1544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbclient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbclient.dll,#1
2⤵
PID:1696