5cfb909e292a273221259b47fc55c231259f955f00cbe367414b539991d8bfab

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 09:38

Target

virussign.com_5cc61af1dfa4ed6f95a9e7fa9b0821e0.dll
Size

111KB
MD5

5cc61af1dfa4ed6f95a9e7fa9b0821e0
SHA1

99066fd36455f7189dea68f1c617fe0047a0e815
SHA256

5cfb909e292a273221259b47fc55c231259f955f00cbe367414b539991d8bfab
SHA512

449be718f66eda78b93b044ec6cd60d41330ae7dd100790d4398fa8422d08f5ecc002e9426ffd114e4a64f4fc01e60b556972018038ada8bcd2f48c6bf86641e
SSDEEP

3072:xnL7Ot6WLta8ptY9+GRkor1/z6Sbe+jmsPANY:RAtawtYBzr1WthyANY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2200	1544	rundll32.exe	28
PID 1544 wrote to memory of 2200	1544	rundll32.exe	28
PID 1544 wrote to memory of 2200	1544	rundll32.exe	28
PID 1544 wrote to memory of 2200	1544	rundll32.exe	28
PID 1544 wrote to memory of 2200	1544	rundll32.exe	28
PID 1544 wrote to memory of 2200	1544	rundll32.exe	28
PID 1544 wrote to memory of 2200	1544	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.com_5cc61af1dfa4ed6f95a9e7fa9b0821e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.com_5cc61af1dfa4ed6f95a9e7fa9b0821e0.dll,#1
  2⤵
  PID:2200