3682f63442374a284f1b5f996da477f3cf024ffd5fa5f2bf064ef80136b81a04

Analysis

max time kernel
307s
max time network
320s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 07:15

Target

Quasar_Gold/Include/NCC2.dll
Size

13KB
MD5

12e7983a050a5f7f7b501d3cda914248
SHA1

6ce5d9b763fc05dcdfcaea79a62a8352371d749c
SHA256

a0b6bb521e52a99abf5ac1017302da014d37296619078d42d9edf5d86d137f63
SHA512

0b8788c858c35e0f8f56d552518adb71c847240f6d7c199243e046c4c2e2ae32cb035a0bc5098631656c5d7d772be4fdfdc6a4e19e00092fb3eb09044998be97
SSDEEP

192:jKsAWXvf+AxcTC6xFrnT5xoqMSqzqqJocD/HCtVWAc3XTEqx2CvAPhz:9Z/f+XT/xBwqMSqeqqcmUDhKhz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3016	2764	rundll32.exe	28
PID 2764 wrote to memory of 3016	2764	rundll32.exe	28
PID 2764 wrote to memory of 3016	2764	rundll32.exe	28
PID 2764 wrote to memory of 3016	2764	rundll32.exe	28
PID 2764 wrote to memory of 3016	2764	rundll32.exe	28
PID 2764 wrote to memory of 3016	2764	rundll32.exe	28
PID 2764 wrote to memory of 3016	2764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\NCC2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\NCC2.dll,#1
  2⤵
  PID:3016