f3613f5434d874490f600424a5c226cb36de3d8ce41a319f9321f4f845501ae0

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 13:18

Target

$APPDATA/seemao/config/Common.dll
Size

219KB
MD5

e24fe22eb8f1d79ee950fc1a6efb1079
SHA1

73335d9a0db7d058ffe6a22d3ab3de9d3aacb64c
SHA256

21c0f0b476806e657c5094219411ab6715d294b75a3e45922ce11a29a18002a9
SHA512

b728d0eedbe8e6b63975f26a90080bb43b4f65d4f09c8dab6a4c15356cc17dcdd1d4f601cb48f41c78787c9f926d22857d027cc5a0f83ed5b70683827bf61040
SSDEEP

3072:hVJKdXOSqYf+0HOH3YUCD+YAeX7jfrT+btk9TBfCDUvtmSIVlIgP4:hVJwqYm03UCiPeXvTTQ29TBqDUNIjRP4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1268	1756	rundll32.exe	30
PID 1756 wrote to memory of 1268	1756	rundll32.exe	30
PID 1756 wrote to memory of 1268	1756	rundll32.exe	30
PID 1756 wrote to memory of 1268	1756	rundll32.exe	30
PID 1756 wrote to memory of 1268	1756	rundll32.exe	30
PID 1756 wrote to memory of 1268	1756	rundll32.exe	30
PID 1756 wrote to memory of 1268	1756	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\Common.dll,#1
  2⤵
  PID:1268