0c860b7f821fc9d1ac0d91410201743febcf459b95c848529a8f816a9309a240

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 22:53

Target
CheckTudouVa.dll
Size 254KB
Sample240612-2t4f1stfmg
SHA256 a78e96a9645e1f04070795b45aae20582331f2de325b39a844a5b02e62c46984
MD5 f11a3eb69c056057b6c65eb24ca79b14
SHA1 2fd09f10f58dac2f411abf537e80f37288578235
SHA512 c59343785b97fcc0584cecfbe80ecd8d340abfc847cbb8b252678c4127cf666acf5b61831a65222c2d2707799a7e5dd98805cac261f05f4c7f48a2d778c29671
SSDEEP 3072:ycWpVI2KJm7/UE8t0BMWs1rX+n+wP6ceCD2/vPrq5oUJQPvWUyN27QeCR:5WNKULBJs1z++wMb0oUmmOU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2412	2384	rundll32.exe	28
PID 2384 wrote to memory of 2412	2384	rundll32.exe	28
PID 2384 wrote to memory of 2412	2384	rundll32.exe	28
PID 2384 wrote to memory of 2412	2384	rundll32.exe	28
PID 2384 wrote to memory of 2412	2384	rundll32.exe	28
PID 2384 wrote to memory of 2412	2384	rundll32.exe	28
PID 2384 wrote to memory of 2412	2384	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CheckTudouVa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CheckTudouVa.dll,#1
  2⤵
  PID:2412