38ddef65caed8667cf609413b6f3c6722542239fd6c8e2ce6fb9cc43a2a3ef0e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 13:30

Target

SecuriteInfo.com.Trojan.Click2.55197.9468.dll
Size

1.8MB
MD5

3175c40ff0c5b9d7346ac0f3772dfaa2
SHA1

06eeb3f63b5a16e7fdf41c0d17869c2657fd622b
SHA256

38ddef65caed8667cf609413b6f3c6722542239fd6c8e2ce6fb9cc43a2a3ef0e
SHA512

b8dcf3a81baf7a446f748b88edb723b624ecbe930dbff2cb359d6e641e985ff1b76f0286f0307f371b775b3b91f412097dfed666a57cb54de0ceb3bcfea65dd9
SSDEEP

24576:V9ah+UklQtDMSnx21r8bwTjuWrDU4Ag+aDq4Ue764d5G+ZU5s8tbsodiwKUSVQxN:V97UIUgSnx21rLdDMw5G+yftXFFOvNo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2248	844	rundll32.exe	28
PID 844 wrote to memory of 2248	844	rundll32.exe	28
PID 844 wrote to memory of 2248	844	rundll32.exe	28
PID 844 wrote to memory of 2248	844	rundll32.exe	28
PID 844 wrote to memory of 2248	844	rundll32.exe	28
PID 844 wrote to memory of 2248	844	rundll32.exe	28
PID 844 wrote to memory of 2248	844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Click2.55197.9468.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Click2.55197.9468.dll,#1
  2⤵
  PID:2248