bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:19

Target

MedicareSign/astprint.dll
Size

14KB
MD5

02f50ce43aa143a0a933036d4897879e
SHA1

0cc00f804fb902f7420fcbe8633a0991c7e1f49c
SHA256

9b1231d03c4cc88cca0dd224cb4059e2cfadeff9a5ef9f082c1da99e4ca95360
SHA512

da7573f2cb76798fc4845284857540cf4093228084f30b9230497268fd6a5e60a9246b63a5915b3dd192e60143e4fc17427d6c316392de1be60071dec57d686f
SSDEEP

192:J8QxCQybcQQybzW6kwCiEHio27aefHix86Tq7Y4odAUhUZQwg2G4lYqufZnIcfx:PVkntCi0GtCxXBhge4GfZIcfx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30
PID 1684 wrote to memory of 2212	1684	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\astprint.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\astprint.dll,#1
  2⤵
  PID:2212

memory/2212-0-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/2212-1-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

Filesize
4KB

Download
memory/2212-2-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/2212-3-0x0000000075340000-0x000000007534A000-memory.dmp

Filesize
40KB

Download