52ed440aa643c06a63db44a5572d2c97225d11934fa36c8b54172cf6de3cdc0c

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 19:17

Target

$APPDATA/CCTV/tv/CCTVPlayer.dll
Size

57KB
MD5

463de747653e6979570c34cd210eea51
SHA1

bec506e4b571328d5c0977c7958334e10482ee5a
SHA256

4c0c18a451939527be2509de185434e83d3837a473e5d83d1e145067d33927b9
SHA512

b806f8efc51838c2165223aed36f952b19797e11e0c82bc2154c4a88d5343041d8ecaba298bc7f1f33fc48b60dd1b6d3c693348f90a09ef0c21bbc1af97a389b
SSDEEP

1536:oqJz27FF2v/8hGss+cuzf81T9EVRjvlO40ENj68dYv:9JqW8Hs+cuzf8B9oVc40ENjPiv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2180	2924	rundll32.exe	28
PID 2924 wrote to memory of 2180	2924	rundll32.exe	28
PID 2924 wrote to memory of 2180	2924	rundll32.exe	28
PID 2924 wrote to memory of 2180	2924	rundll32.exe	28
PID 2924 wrote to memory of 2180	2924	rundll32.exe	28
PID 2924 wrote to memory of 2180	2924	rundll32.exe	28
PID 2924 wrote to memory of 2180	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\CCTV\tv\CCTVPlayer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\CCTV\tv\CCTVPlayer.dll,#1
  2⤵
  PID:2180