5341b3921b75549adbe59365517c30bd045e63162728d9ba48f79832fea1bea0

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 17:21

Target
ConnectifyNAT.dll
Size 288KB
Sample240124-vxb3lsecfl
SHA256 9bfaa78a288f894ead9bbe616b24c777c5da76ffbc9ed03aa3d8e4a3c954ffe7
MD5 d1e979c80f3a75fdab05462dad383bc3
SHA1 e8ef2c8fe5b45888020dce862dd4c7ae59c0be20
SHA512 ff2a2970988b7abf4563b94908a355d49720e993750807ee64b7f0439c0f1dfdf6aa0cea5323594ecf3f8094698408f02d665118b1c8710643afecf61f258a65
SSDEEP 6144:Tj9PE42T+v4PlM+IsRb+q1jrdVrNGZam0Z4Ocy:piaq1j9o90Zlp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 3052	2108	rundll32.exe	28
PID 2108 wrote to memory of 3052	2108	rundll32.exe	28
PID 2108 wrote to memory of 3052	2108	rundll32.exe	28
PID 2108 wrote to memory of 3052	2108	rundll32.exe	28
PID 2108 wrote to memory of 3052	2108	rundll32.exe	28
PID 2108 wrote to memory of 3052	2108	rundll32.exe	28
PID 2108 wrote to memory of 3052	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConnectifyNAT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConnectifyNAT.dll,#1
  2⤵
  PID:3052

memory/3052-0-0x0000000001FE0000-0x0000000002187000-memory.dmp

Download