394367fbf7fcaed9fce1ed15d17329b644538e5e1b7f5fa7b3ff55ca2d6ce658

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 17:08

Target

1.2.6.0/run.dist/tcl86t.dll
Size

1.7MB
MD5

b0261de5ef4879a442abdcd03dedfa3c
SHA1

7f13684ff91fcd60b4712f6cf9e46eb08e57c145
SHA256

28b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e
SHA512

e39a242e321e92761256b2b4bdde7f9d880b5c64d4778b87fa98bf4ac93a0248e408a332ae214b7ffd76fb9d219555dc10ab8327806d8d63309bf6d147ebbd59
SSDEEP

24576:+AZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDA:+A0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2856	1984	rundll32.exe	28
PID 1984 wrote to memory of 2856	1984	rundll32.exe	28
PID 1984 wrote to memory of 2856	1984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.2.6.0\run.dist\tcl86t.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1984 -s 132
  2⤵
  PID:2856

memory/1984-0-0x000007FEF6D30000-0x000007FEF6D5A000-memory.dmp

Filesize
168KB

Download