f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:54

Target

MCL_FPTZ.dll
Size

131KB
MD5

845ad8f36ee751315e148ccb4ffad4b7
SHA1

6e0ffd681541db282dfff684a2d4a6657b6b2567
SHA256

ab8434c64eedeb34994617d113fffae7b2f28b16be387488e2168a7fa64222c2
SHA512

290f022a2924f5db1b383f2313bd1d681b514d30ee4832c2eb9eb04febfc36e26bdad6f3429c3ef25810ddb5376daac174d3f9b594b53e946147827ba2658ac0
SSDEEP

1536:bIW4gFXt7zL4INElaQv+1eIARg+FjOcOjuWXfnywRxOPsGMBNSnt7QukRPcw4i:9l4INEyengJCCh3jBNStX0cw4i

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1368 wrote to memory of 2056	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 2056	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 2056	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 2056	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 2056	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 2056	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 2056	1368	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCL_FPTZ.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCL_FPTZ.dll,#1
2⤵
PID:2056