07ca72bbaedbb178206f8b5d0c5635215e712b854217db93a66b518c5ee5b82c

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 18:12

Target

CONTROL VELOCIDAD INTERNET/Selfishnet win 7/Selfishnet win 7/npptools.dll
Size

47KB
MD5

48311b5a88816c6560a10d9fda75dc7a
SHA1

9c21012b8b86fc0620b8e54be2c69ac4628ccfbf
SHA256

4b722ffbe7f9211a08013318674debfbec33fe66b812d697ee1072d57a01597f
SHA512

5147539b2ccd2d8d08520a831d8fcfea2359e52a73c1b40f11c187f5e91346656aef5cc00549b3828edd1c88e35919325bdc8f9584842132d5d1f64bef5e97ce
SSDEEP

768:balSZfnt2GJtYJFmkBkf7NiT9xL9MJa5+HH1t2XmhXVDwA/x411SdjO7n:mlSZfnJtYJWZE2I5fAVb/x411Shy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1360 wrote to memory of 1528	1360	rundll32.exe	rundll32.exe
PID 1360 wrote to memory of 1528	1360	rundll32.exe	rundll32.exe
PID 1360 wrote to memory of 1528	1360	rundll32.exe	rundll32.exe
PID 1360 wrote to memory of 1528	1360	rundll32.exe	rundll32.exe
PID 1360 wrote to memory of 1528	1360	rundll32.exe	rundll32.exe
PID 1360 wrote to memory of 1528	1360	rundll32.exe	rundll32.exe
PID 1360 wrote to memory of 1528	1360	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONTROL VELOCIDAD INTERNET\Selfishnet win 7\Selfishnet win 7\npptools.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONTROL VELOCIDAD INTERNET\Selfishnet win 7\Selfishnet win 7\npptools.dll",#1
2⤵
PID:1528

memory/1528-54-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download