12978eef9daed92259dc10c461bdf027cc646b49425f9941da73d4ded1483d86

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 20:18

Target

MFC100U.dll
Size

4.2MB
MD5

f3de10aabd5c7a1a186c9966f037d0c0
SHA1

6aaae8331a5377f4025d2d860e5872b842a41df8
SHA256

bc50848aeef466dff4a3d8c386bf0d0ec35b8e5b438031ae885aa5371f2e1a42
SHA512

07d93b8abbf8acfab1d8f0711a37086764000310450ba361e7d5e1369012b3a45fd394460841b0f3cca79acead2080bbe1f029bc36191c133d7ccea182ca84e1
SSDEEP

98304:veeKejRb6KYYRzl1rYBrAWpTmms3Ctm8oVXK0na6g3QAt1zwoN1R4FLOAkGkzdnr:v8NpL84jN1eFLOyomFHKnPAu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1708	1952	rundll32.exe	28
PID 1952 wrote to memory of 1708	1952	rundll32.exe	28
PID 1952 wrote to memory of 1708	1952	rundll32.exe	28
PID 1952 wrote to memory of 1708	1952	rundll32.exe	28
PID 1952 wrote to memory of 1708	1952	rundll32.exe	28
PID 1952 wrote to memory of 1708	1952	rundll32.exe	28
PID 1952 wrote to memory of 1708	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MFC100U.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MFC100U.dll,#1
  2⤵
  PID:1708