45eaf956ae85dd33e34ff4ee1413442d5d05017aa949de02a382a9317c9ed6e2

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 01:20

Target
client/TCCTL32.dll
Size 382KB
Sample240502-bp4ccach3t
SHA256 092c3ec01883d3b4b131985b3971f7e2e523252b75f9c2470e0821505c4a3a83
MD5 405a7bca024d33d7d6464129c1b58451
SHA1 22b64e211d96d773c510ac82e7a73f8debf4e4cd
SHA512 3c8d4cbf377a8beb793c93b63d521ccd75167dec02da43bb91434cb6b0737ca2d61fa201f2825fd1a0ceaae768bb53d78f737e7c412aae83d3cdc748893f31e6
SSDEEP 6144:/0pwbUb486Yu0LIFZf4TktH4aY384az44lstAZPVJ4hPueU12jXvbJaS0T9XjJpX:8pwbUb48Ju0LIFZf4Tk2aY3FasNAZtJp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\client\TCCTL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\client\TCCTL32.dll,#1
  2⤵
  PID:3016