c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 09:33

Target

FCK_RSC.dll
Size

8KB
MD5

aabeb05e642b2f9acb86a5dc1a600813
SHA1

abba695b782c0e644b971b65d4dc7b8349714488
SHA256

8b1d4870fdc940da538f225251996794f2f10ab7fff718d1aa884be8468dcfce
SHA512

730fd04e4624f4db8c7c92e786148139d457c5bdc28badb3b1cbb70b61fd7b20655c2feab90c5c91b0d30f42a2d7bccb2ce0120752e223e6df2139c371b4be8a
SSDEEP

96:b/TFVUFXleWwunodJsFDgt1CEiRgWY3ZbBNVyJ6/xMWwWHB6KJAso9Rdtoewc:fUFXlemctwgRPNVyJ6/eWwWhlDoHgzc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1204	1316	rundll32.exe	28
PID 1316 wrote to memory of 1204	1316	rundll32.exe	28
PID 1316 wrote to memory of 1204	1316	rundll32.exe	28
PID 1316 wrote to memory of 1204	1316	rundll32.exe	28
PID 1316 wrote to memory of 1204	1316	rundll32.exe	28
PID 1316 wrote to memory of 1204	1316	rundll32.exe	28
PID 1316 wrote to memory of 1204	1316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCK_RSC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCK_RSC.dll,#1
  2⤵
  PID:1204