07ca72bbaedbb178206f8b5d0c5635215e712b854217db93a66b518c5ee5b82c

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 18:12

Target

CONTROL VELOCIDAD INTERNET/Selfishnet win 7/Selfishnet win 7/PcapNet.dll
Size

164KB
MD5

54dbc0a3028aba8c8d23e1aee623331c
SHA1

0dd7cfe6c744ec3f0142805cf1674c12200d27e2
SHA256

0422466d93ea14c71a7c2a471fdaf092ad87e5b57f6bd3662e1f01d43339e4ce
SHA512

c8bce44b0f86653fb394400240d215eb28a0a96f01b30b78756ebe498340e5d5ba7fba30c4e1ab1d647ebb7f32d5680f688b80b9c4f40a919c0e80ec825eb019
SSDEEP

3072:zb9m50GU9BmSxH5NWq/ki1nhkFovBvv96G8L0aKvp:1m5GBdLr1ntF6Gfa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1744 wrote to memory of 1196	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1196	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1196	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1196	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1196	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1196	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1196	1744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONTROL VELOCIDAD INTERNET\Selfishnet win 7\Selfishnet win 7\PcapNet.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONTROL VELOCIDAD INTERNET\Selfishnet win 7\Selfishnet win 7\PcapNet.dll",#1
2⤵
PID:1196

memory/1196-54-0x0000000000000000-mapping.dmp

Download
memory/1196-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1196-56-0x00000000001D0000-0x00000000001E7000-memory.dmp

Filesize
92KB

Download
memory/1196-57-0x00000000001F0000-0x0000000000201000-memory.dmp

Filesize
68KB

Download