5e2664915cca76389e3e9a87b391f250d7e9994c7f00508deb86b0fd79d29c51

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 23:16

Target

MsCtfMonitor.dll
Size

819KB
MD5

bc32ab39c7e605eedd0c0fb6c4eb29bf
SHA1

e562b1442f479b891dc8d60060fbd58eeb76af1c
SHA256

36d6d51fdd9cdab34267433c7ff390a0ed5d03c3633021cc71ff849cbc7f91e2
SHA512

21aed20885577ac974ac11b02a2300c68bb8a270f50c78027d6044917750e50a7b413bac678272cd291bb6b38d8649c2082b4ed942b68bbb8c3144ca82a5d6a3
SSDEEP

12288:M8KzFSvguMxJB1TUp+PPzu339U0Xq7IVgVFIbgYBwSFdjUh2e0kiCz888888888O:8KgusJB1TUpR339TTVZbnBwSzC2eX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2104	2868	rundll32.exe	28
PID 2868 wrote to memory of 2104	2868	rundll32.exe	28
PID 2868 wrote to memory of 2104	2868	rundll32.exe	28
PID 2868 wrote to memory of 2104	2868	rundll32.exe	28
PID 2868 wrote to memory of 2104	2868	rundll32.exe	28
PID 2868 wrote to memory of 2104	2868	rundll32.exe	28
PID 2868 wrote to memory of 2104	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MsCtfMonitor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MsCtfMonitor.dll,#1
  2⤵
  PID:2104

memory/2104-0-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-1-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-2-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-3-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-4-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-5-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-6-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-7-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-8-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-9-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-10-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-11-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-12-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-13-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download
memory/2104-14-0x0000000000200000-0x00000000002D8000-memory.dmp

Filesize
864KB

Download