68b729d1c7e6b424b230931dc74db2c90c08d4923130582c80a295e144dba43f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 16:35

Target

$COMMONFILES/nProtect Shared/Engine/TeCtrl.dll
Size

490KB
MD5

8d3ae4c2855e284729e8d9be16a3639f
SHA1

60c7d9c4f3132d27bade1546001dff285a26811f
SHA256

793b526351ccacc0757f4dec8015c2dd3fc608bd14765ab191f067e17106c96a
SHA512

c818d1d2184c7980ec74ec6c3aa72e555b43d08c0d628c81145bb4272719594eae34a367a8a2943de1d9562824d45afd56262e1ad7d6cc098a12fb92e3de7358
SSDEEP

6144:4R1Ca5NhWtNE9jTpla9UftFwYxg1u+kNwJdWKYcxkzNqJPEYny:81Ca5NhWUE9fYxgwQx8Nany

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2340	2288	rundll32.exe	28
PID 2288 wrote to memory of 2340	2288	rundll32.exe	28
PID 2288 wrote to memory of 2340	2288	rundll32.exe	28
PID 2288 wrote to memory of 2340	2288	rundll32.exe	28
PID 2288 wrote to memory of 2340	2288	rundll32.exe	28
PID 2288 wrote to memory of 2340	2288	rundll32.exe	28
PID 2288 wrote to memory of 2340	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\TeCtrl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\TeCtrl.dll",#1
  2⤵
  PID:2340