5c8c5985ccadf49c31db958ab37bf9364bd9275501dd186c60eb62a5fee4b34b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 06:23

Target
Communicate.dll
Size 44KB
Sample240113-g5stfaebc6
SHA256 d8c3c617831db57e6f8ab272dd9b2b9f7ea8002229c4df1a9db5d921e8c61876
MD5 102b9fe06b7a8cad9af32737308cf707
SHA1 eb0743e1a849f5331ecf1ac8dc68c440f220fb0c
SHA512 77c9cb2a93f8c8de06ea29ab28f8969cd2bafae0ff2aa594b6f60aaab30ff3b98fa87152ef9fa3f8a69426a9f4734ddcd82635cd49118f9781ef7bfde918bc8f
SSDEEP 768:UJd5AiLoDQ/4+TnGvippFxqWLCxfFHoUpw:UJd5AiP4+Tngip34thov
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2672	1056	rundll32.exe	28
PID 1056 wrote to memory of 2672	1056	rundll32.exe	28
PID 1056 wrote to memory of 2672	1056	rundll32.exe	28
PID 1056 wrote to memory of 2672	1056	rundll32.exe	28
PID 1056 wrote to memory of 2672	1056	rundll32.exe	28
PID 1056 wrote to memory of 2672	1056	rundll32.exe	28
PID 1056 wrote to memory of 2672	1056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Communicate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Communicate.dll,#1
  2⤵
  PID:2672