d7446d53db2a8beb613d435e086ce6767bedf4bbef60ec2aa04420ba364756eb

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 02:12

Target

client/TCCTL32.dll
Size

382KB
MD5

405a7bca024d33d7d6464129c1b58451
SHA1

22b64e211d96d773c510ac82e7a73f8debf4e4cd
SHA256

092c3ec01883d3b4b131985b3971f7e2e523252b75f9c2470e0821505c4a3a83
SHA512

3c8d4cbf377a8beb793c93b63d521ccd75167dec02da43bb91434cb6b0737ca2d61fa201f2825fd1a0ceaae768bb53d78f737e7c412aae83d3cdc748893f31e6
SSDEEP

6144:/0pwbUb486Yu0LIFZf4TktH4aY384az44lstAZPVJ4hPueU12jXvbJaS0T9XjJpX:8pwbUb48Ju0LIFZf4Tk2aY3FasNAZtJp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1632	992	rundll32.exe	28
PID 992 wrote to memory of 1632	992	rundll32.exe	28
PID 992 wrote to memory of 1632	992	rundll32.exe	28
PID 992 wrote to memory of 1632	992	rundll32.exe	28
PID 992 wrote to memory of 1632	992	rundll32.exe	28
PID 992 wrote to memory of 1632	992	rundll32.exe	28
PID 992 wrote to memory of 1632	992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\client\TCCTL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\client\TCCTL32.dll,#1
  2⤵
  PID:1632