72b7069c3950d4241d0f4849bc108122e51e9b147718bb33c4b3cf75d93a966b

Resubmissions

19/06/2024, 02:16

19/06/2024, 02:10

19/06/2024, 02:02

18/06/2024, 09:33

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 02:10

Target
MicrosoftVisualStudioTeamTestTestGenerationCci.dll
Size 370KB
Sample240619-clsbcasbjf
SHA256 e3f8686069d409d3bbe7ff48f78aef8588dd6835926501c8e4c9bf0fcf233982
MD5 d67781be7900f048c5735f4ecb0cbf1d
SHA1 5ecae46f829fafd4a88d936d4d44fcd631720f81
SHA512 25ac60d42a7e2901016329f373775e708186781ea1ab92ba441456afb8c2a4c3b342580d6d92a1ba629367e5d8a7cbf0e20e8f7b4307acdf749ca466874f1681
SSDEEP 6144:YARM2Xq9IR2+O6Z4HkxHbjhZjU8W0veyu:YARQiik4H6TU9r
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftVisualStudioTeamTestTestGenerationCci.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MicrosoftVisualStudioTeamTestTestGenerationCci.dll,#1
  2⤵
  PID:2668