f166ff7bf5585d3cff368be6a5a51673c57bb24df6c555619ee3e90c7f066a3d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/03/2024, 06:49

Target
$SYSDIR/UCLiveSocket.dll
Size 236KB
Sample240304-hll28acd21
SHA256 6bb88490b9900b3224bd16e51d04d7aabb797fb3b4a667d881bfcf2998849253
MD5 d26b2a4cc625665d559093d11f2a9a8d
SHA1 a41bc98ee40ba6e968aa5b474c14dd35003b357c
SHA512 4a3e434793234b8768a746513cf5a4fe0af054b5278f7688d82e80127027b81e21e10d13821f3084254cb80b09a5d8ef313f5c1635328ac5d9ed8029f49ea1cf
SSDEEP 3072:M1wrwjQ039wj42yOnjptvt3g4OkoiltFKDd5toZtavThzyP:mwMc62xgTHgcB5tJFy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28
PID 2040 wrote to memory of 2308	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\UCLiveSocket.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\UCLiveSocket.dll,#1
  2⤵
  PID:2308