d2623ed0469b4a7a8f9371cb91bad7bb803564bdda76fdcc5972905edb12f8b9

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 18:47

Target

ibprovider.dll
Size

22KB
MD5

7c9ff12366ec3cd4228506865b239709
SHA1

97846f581197cc21fcce278a83676aaa0096742e
SHA256

81c948d694ccd20538284500ae0eb3c3d3c01234012e0df8afc93265048ed3fc
SHA512

ef5311c31a0268ab439bedfd8d7109ee4e31c323d683aab4df5b03d00ce5a347163daebdb088a0b627afb296787a510da5bf36c55b6be767f19482c89d7a3f75
SSDEEP

384:j83zxzEW+gOvVdBka+J7DRY3BZs7rgzV+5UDPqTT+qdutl/ctSNGx5XORAjHQPy7:Y6NoDWjs7CU+qYnkFORiwPyn7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2864 wrote to memory of 2880	2864	rundll32.exe	rundll32.exe
PID 2864 wrote to memory of 2880	2864	rundll32.exe	rundll32.exe
PID 2864 wrote to memory of 2880	2864	rundll32.exe	rundll32.exe
PID 2864 wrote to memory of 2880	2864	rundll32.exe	rundll32.exe
PID 2864 wrote to memory of 2880	2864	rundll32.exe	rundll32.exe
PID 2864 wrote to memory of 2880	2864	rundll32.exe	rundll32.exe
PID 2864 wrote to memory of 2880	2864	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ibprovider.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ibprovider.dll,#1
2⤵
PID:2880