d7446d53db2a8beb613d435e086ce6767bedf4bbef60ec2aa04420ba364756eb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 00:54

Target
client/TCCTL32.dll
Size 382KB
Sample240502-a88whaec64
SHA256 092c3ec01883d3b4b131985b3971f7e2e523252b75f9c2470e0821505c4a3a83
MD5 405a7bca024d33d7d6464129c1b58451
SHA1 22b64e211d96d773c510ac82e7a73f8debf4e4cd
SHA512 3c8d4cbf377a8beb793c93b63d521ccd75167dec02da43bb91434cb6b0737ca2d61fa201f2825fd1a0ceaae768bb53d78f737e7c412aae83d3cdc748893f31e6
SSDEEP 6144:/0pwbUb486Yu0LIFZf4TktH4aY384az44lstAZPVJ4hPueU12jXvbJaS0T9XjJpX:8pwbUb48Ju0LIFZf4Tk2aY3FasNAZtJp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1032	3064	rundll32.exe	28
PID 3064 wrote to memory of 1032	3064	rundll32.exe	28
PID 3064 wrote to memory of 1032	3064	rundll32.exe	28
PID 3064 wrote to memory of 1032	3064	rundll32.exe	28
PID 3064 wrote to memory of 1032	3064	rundll32.exe	28
PID 3064 wrote to memory of 1032	3064	rundll32.exe	28
PID 3064 wrote to memory of 1032	3064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\client\TCCTL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\client\TCCTL32.dll,#1
  2⤵
  PID:1032