07ca72bbaedbb178206f8b5d0c5635215e712b854217db93a66b518c5ee5b82c

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 18:12

Target

CONTROL VELOCIDAD INTERNET/Selfishnet win 7/Selfishnet win 7/npptools.dll
Size

47KB
MD5

48311b5a88816c6560a10d9fda75dc7a
SHA1

9c21012b8b86fc0620b8e54be2c69ac4628ccfbf
SHA256

4b722ffbe7f9211a08013318674debfbec33fe66b812d697ee1072d57a01597f
SHA512

5147539b2ccd2d8d08520a831d8fcfea2359e52a73c1b40f11c187f5e91346656aef5cc00549b3828edd1c88e35919325bdc8f9584842132d5d1f64bef5e97ce
SSDEEP

768:balSZfnt2GJtYJFmkBkf7NiT9xL9MJa5+HH1t2XmhXVDwA/x411SdjO7n:mlSZfnJtYJWZE2I5fAVb/x411Shy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1528	1360	rundll32.exe	27
PID 1360 wrote to memory of 1528	1360	rundll32.exe	27
PID 1360 wrote to memory of 1528	1360	rundll32.exe	27
PID 1360 wrote to memory of 1528	1360	rundll32.exe	27
PID 1360 wrote to memory of 1528	1360	rundll32.exe	27
PID 1360 wrote to memory of 1528	1360	rundll32.exe	27
PID 1360 wrote to memory of 1528	1360	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONTROL VELOCIDAD INTERNET\Selfishnet win 7\Selfishnet win 7\npptools.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONTROL VELOCIDAD INTERNET\Selfishnet win 7\Selfishnet win 7\npptools.dll",#1
  2⤵
  PID:1528

memory/1528-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download