cb6cb79c57df1a21b9ce6a260a427f1c07699879a7f1933f1dd628cef4da3842

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 15:06

Target

$SYSDIR/msvcp80.dll
Size

536KB
MD5

4c8a880eabc0b4d462cc4b2472116ea1
SHA1

d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA256

2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
SHA512

6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
SSDEEP

12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2844	2120	rundll32.exe	28
PID 2120 wrote to memory of 2844	2120	rundll32.exe	28
PID 2120 wrote to memory of 2844	2120	rundll32.exe	28
PID 2120 wrote to memory of 2844	2120	rundll32.exe	28
PID 2120 wrote to memory of 2844	2120	rundll32.exe	28
PID 2120 wrote to memory of 2844	2120	rundll32.exe	28
PID 2120 wrote to memory of 2844	2120	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcp80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\msvcp80.dll,#1
  2⤵
  PID:2844