45e083d1e59e1c476d4d62b91cb14d97c4bda14ccc4a6170499a4a4d87094c97

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:23

Target

CnCalendar.dll
Size

256KB
MD5

f23720ebd9ece53913037ab9e2e110e0
SHA1

d92350c9d0766e57ae28390bff6a34a35f6ab0cd
SHA256

d8087c65399b1b0574ac3dbf76435fe85fe2bdd418157b2e5a806221cb642e5e
SHA512

11af224e093ac91d8b921126b3ec9154acfb216c4362ee356336969f2390e363a977d041885cd368f1cbca9b54838758cb95bc8808299ba2ef761e0186709aed
SSDEEP

3072:6iPNKV7W/AMrjTHsIKfUaRqg62qWUuWZhQwmyo5Lqb2pZyZd+dQzorxK4KgcbU7I:f5AMzMIKfUgeMCg+2ptdQzwq/QU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3040	3000	rundll32.exe	14
PID 3000 wrote to memory of 3040	3000	rundll32.exe	14
PID 3000 wrote to memory of 3040	3000	rundll32.exe	14
PID 3000 wrote to memory of 3040	3000	rundll32.exe	14
PID 3000 wrote to memory of 3040	3000	rundll32.exe	14
PID 3000 wrote to memory of 3040	3000	rundll32.exe	14
PID 3000 wrote to memory of 3040	3000	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CnCalendar.dll,#1
1⤵
PID:3040

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CnCalendar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000