2ceb5c5638d720ba64f92ba8e5742aff5c2ed0b2a5571ecc5fef0a2ff9c93699

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 15:45

Target
PCICL32.dll
Size 3.6MB
Sample240110-s7ev5sbbe4
SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
MD5 00587238d16012152c2e951a087f2cc9
SHA1 c4e27a43075ce993ff6bb033360af386b2fc58ff
SHA512 637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226
SSDEEP 49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3016	1648	rundll32.exe	28
PID 1648 wrote to memory of 3016	1648	rundll32.exe	28
PID 1648 wrote to memory of 3016	1648	rundll32.exe	28
PID 1648 wrote to memory of 3016	1648	rundll32.exe	28
PID 1648 wrote to memory of 3016	1648	rundll32.exe	28
PID 1648 wrote to memory of 3016	1648	rundll32.exe	28
PID 1648 wrote to memory of 3016	1648	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCICL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCICL32.dll,#1
  2⤵
  PID:3016