55453f794fbc569bf4afdf593aa27ff863bf1e1c67c7ccb5eb7bf48f29ff0de4

Analysis

max time kernel
315s
max time network
387s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/05/2024, 16:08

Target

$SYSDIR/CFCA_HSBC_GMAPI.dll
Size

157KB
MD5

c29ac30451c9ebfdd175db086c8d82e2
SHA1

cbb269459f244425fd6ec1db8088a267446433af
SHA256

5ba4585be6c8c895d9a66f21693682dd3b58279ef0cdf1479b841a12f96114f3
SHA512

9c5ed13dacfea957bdbe7473af071394d0c98daec0012027ba5c779f4577923ed76a0b3b0a57432be4e8102cf9d344a03cc4bd933d04bd281a4f22e4d0014406
SSDEEP

3072:dViHRlJrLeFRKMdHtpBVwMKeyIQXYMAqHROUPUYYEFuUCiWiHxzi:eHRlJriFHdHtpBVwMKeyIQXYKHROM3RW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4540	1468	rundll32.exe	73
PID 1468 wrote to memory of 4540	1468	rundll32.exe	73
PID 1468 wrote to memory of 4540	1468	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CFCA_HSBC_GMAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CFCA_HSBC_GMAPI.dll,#1
  2⤵
  PID:4540