bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/AstCrp.dll
Size

171KB
MD5

dbb4bccfe8fee299d555a19865c41921
SHA1

a6c494854ca8bec80c05e259a9d8d9346ec61786
SHA256

45e87d7421b6b65c207e8d564a4e54dcdab7b104b83341f63d348f8894bde992
SHA512

5b5b6091655801c984e87a5de4b8c3771b7ff8a069206662650ba652711db48a4912a613015c2254215ccbd252c475c4a4f00efcb1e0dfb404c6736746a187a4
SSDEEP

3072:SNqEUD0UXALbdEHP5HJ1XDhaWwJ/kYc3e2uYOAg0FujDX8fLa/DNqulyZpx:IUqVy1Xta7tkV2AOHkulU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2548	2416	rundll32.exe	30
PID 2416 wrote to memory of 2548	2416	rundll32.exe	30
PID 2416 wrote to memory of 2548	2416	rundll32.exe	30
PID 2416 wrote to memory of 2548	2416	rundll32.exe	30
PID 2416 wrote to memory of 2548	2416	rundll32.exe	30
PID 2416 wrote to memory of 2548	2416	rundll32.exe	30
PID 2416 wrote to memory of 2548	2416	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\AstCrp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\AstCrp.dll,#1
  2⤵
  PID:2548