9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 02:57

Target

todolist_exe/Gma.CodeCloud.Controls.dll
Size

47KB
MD5

f4e70aa2ba3cb8ab0a349266df88600c
SHA1

b871c5b116e06eaf22f0c559e586efc9f35185e3
SHA256

0a412d45db0f1f6270b62297ce50b75ba754a526ec76b2d73e0b51e4f63bf07f
SHA512

249890e1a8e32ff2ad6599f099488ea9d639bbf5544ced84ee060f7c7689c49b43f581a7beb910fb80d8e9402357017a93c32f994ef378e6d26caebe274d7c55
SSDEEP

768:3QWg+SuVaJa7CQrWcZllAaiMmQ1pmLYcoj3Vtc9LB:/g+1Ua7CQScCbGALW3VtcD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2068	1752	rundll32.exe	28
PID 1752 wrote to memory of 2068	1752	rundll32.exe	28
PID 1752 wrote to memory of 2068	1752	rundll32.exe	28
PID 1752 wrote to memory of 2068	1752	rundll32.exe	28
PID 1752 wrote to memory of 2068	1752	rundll32.exe	28
PID 1752 wrote to memory of 2068	1752	rundll32.exe	28
PID 1752 wrote to memory of 2068	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\Gma.CodeCloud.Controls.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\Gma.CodeCloud.Controls.dll,#1
  2⤵
  PID:2068