16a6baf82a2fb1c366cc6f94c382d55172e72855a5e435c898c6429aab2edd3c

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 23:58

Target

$COMMONFILES/PPLiveNetwork/kernel/sop.dll
Size

441KB
MD5

f7a46d933e8065ad872339aa4b69c968
SHA1

b64d12f885131ce4e0ceb3b5cdd6f6b56eeab855
SHA256

e27553f463256aa08ed026a221874a604c40ae3d8f19c37bcff7c6f1228fa153
SHA512

24ca6e9d0d8ed196f8b5f30cc2af2b14bfaa7910386a48903fc92413e2e23249f21becc00751f2057698b97ebb62576efd8ca6e4c9e5f003173b33cdcc04516e
SSDEEP

12288:v6DCYXjWaSMWCX4906BJZVY+dO9bZBdb0p:v6GOs3906BJZVY+dAZBdb0p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2208	2076	rundll32.exe	28
PID 2076 wrote to memory of 2208	2076	rundll32.exe	28
PID 2076 wrote to memory of 2208	2076	rundll32.exe	28
PID 2076 wrote to memory of 2208	2076	rundll32.exe	28
PID 2076 wrote to memory of 2208	2076	rundll32.exe	28
PID 2076 wrote to memory of 2208	2076	rundll32.exe	28
PID 2076 wrote to memory of 2208	2076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\kernel\sop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\kernel\sop.dll,#1
  2⤵
  PID:2208