cc3fbfa0fa74fbc726e44e82698122ef072faba171c51b65c769b79b359d6790

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 22:19

Target

$TEMP/SCSKAPPLink.dll
Size

927KB
MD5

c4bdc6443f4f8e3d1bf5f553df48c9fc
SHA1

165abc3428c9ee33939eab2329a216b29c7650c5
SHA256

b9d845d37306f812538599597c969135f0b57c3c4eea7d395ef8c6dbf491c32a
SHA512

b9de94b2fb630800ad1f5aca1e8ead5d982afcb29054e3f33f602bdf7b6e2d88cfce248278f67a865a73c402073da579d51627aa46d529e90f2990f08f623bf8
SSDEEP

12288:KRlwaunIW7pi0KeUzSkuu4CuXs3Ox8dg5qP0Pqdg5qPgPqdg5qPAPqdgPbdw56PT:DnIMi0K/zws3C7XtNJKQO4XDd

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2672	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2672	2520	rundll32.exe	28
PID 2520 wrote to memory of 2672	2520	rundll32.exe	28
PID 2520 wrote to memory of 2672	2520	rundll32.exe	28
PID 2520 wrote to memory of 2672	2520	rundll32.exe	28
PID 2520 wrote to memory of 2672	2520	rundll32.exe	28
PID 2520 wrote to memory of 2672	2520	rundll32.exe	28
PID 2520 wrote to memory of 2672	2520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SCSKAPPLink.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SCSKAPPLink.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2672