25512356b45d1f25c9f5e1ebfd53005773f95a6354c12aa9e8801f764daf215f

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 16:10

Target

SmartClient/BCP2P_API.dll
Size

148KB
MD5

f481d080f6f86ccdfb59bc349e092903
SHA1

9da75ebe1be17618884f15a74b0e75efa10497e2
SHA256

906e449775c58ff095ffe8fcf04af7f152b481ed09c261802aff3f82c66e10a8
SHA512

ca119c9b119b901309f6635d990090fc5033582ddb4e355f651d558d230d13d6c369f6118c683db658b1bf38caaec7f9db9f564fce66bfc9ab556a1db94ac779
SSDEEP

1536:Gb5H6AwyZwMDEE6ozEyEQFKwDXCcOOmfgC9TRQ0v+jZL4Si2ZoP2YtRk/MfUSg7t:GRnZjDtUXYOOg+BYI2XUotHM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2380 wrote to memory of 1804	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 1804	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 1804	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 1804	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 1804	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 1804	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 1804	2380	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SmartClient\BCP2P_API.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SmartClient\BCP2P_API.dll,#1
2⤵
PID:1804