40e1d0fd5379d48b94dbcef240cfd1af37419e0c232f4e2798016b1339f35b27

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 00:38

Target

OldschoolHack rC13 Css/oshbpcss.dll
Size

179KB
MD5

06fd1a7701c160320a3b7ea7edf96280
SHA1

d2e6b42675f3e243213a3ced338fc2e256351de7
SHA256

79ac583a8572480b52ad16fc6762c9b2cbc344409708947d09f0fbd18eb87c87
SHA512

03cade9f57459eb06ed7197699cd3263dcf9c13c5abcbf3f0492d3dd4b99d30843b1b6a1b5e5d12bf8047fa5bba701ba59e557bfacb90efb50f64a732f1e04fb
SSDEEP

3072:KQeb5wreKOy5KMYFVQhx+bky1al3Y8spl2AJ901Jwu:Krb5wrWvtQhxSkykY8onI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2068	1768	rundll32.exe	28
PID 1768 wrote to memory of 2068	1768	rundll32.exe	28
PID 1768 wrote to memory of 2068	1768	rundll32.exe	28
PID 1768 wrote to memory of 2068	1768	rundll32.exe	28
PID 1768 wrote to memory of 2068	1768	rundll32.exe	28
PID 1768 wrote to memory of 2068	1768	rundll32.exe	28
PID 1768 wrote to memory of 2068	1768	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OldschoolHack rC13 Css\oshbpcss.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OldschoolHack rC13 Css\oshbpcss.dll",#1
  2⤵
  PID:2068