3da6e78e2de91d5f9ff41af0eb84e6be790438a519d2bd5da50ff7bdcb38d8ca

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 03:52

Target
l3oo/SC 1.4.6/appExtension.dll
Size 130KB
Sample240603-ee8e4abf92
SHA256 4fce9dd494bdb79b28da576fa5aead3e220c8d37a3da1af90386c822d90a1c8f
MD5 4bfd917fb83585a4d9c6494a698e453f
SHA1 07071947075892342ea7259a554bc448cd119a0a
SHA512 941fffc881aad9679421b6a411a33f215de100af6db9431944b5ceb2c667249be371ef30efeade9fcebe2d48585606a117592e882e5caabe83aa91dd202c574e
SSDEEP 1536:yND9LcXkXn/GjLy/f7by9LfvxJOqnQ46+hsWNcdgxeoDh66zs6aJx82XY:29oqfqtXTjVmgxeoDh66zzaJJo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2844	1996	rundll32.exe	28
PID 1996 wrote to memory of 2844	1996	rundll32.exe	28
PID 1996 wrote to memory of 2844	1996	rundll32.exe	28
PID 1996 wrote to memory of 2844	1996	rundll32.exe	28
PID 1996 wrote to memory of 2844	1996	rundll32.exe	28
PID 1996 wrote to memory of 2844	1996	rundll32.exe	28
PID 1996 wrote to memory of 2844	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\l3oo\SC 1.4.6\appExtension.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\l3oo\SC 1.4.6\appExtension.dll",#1
  2⤵
  PID:2844