4d8a1e2d043ac44781bd61fe99f089084b24afd490065f0a7987a68ace788237

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 01:26

Target

$_14326_/Plugin/ffccon.dll
Size

60KB
MD5

2d3d949b33fc9cf55ae8f95dc56dae34
SHA1

fe7b97ff89b4fef1088a4cc42343695225151603
SHA256

1537546ad5880701fc5f27ecaf41e50a5c9220bf7c6c37dca4086170b2e64a90
SHA512

2bc4e37f42aabd9b0d98036c4753e87a9e3eb4a42642b154115b226735ff3b93bb44a82c59ffa46cfe2079b93e8fc59e9eb1a6b37e928156b1801d44a1707667
SSDEEP

768:1hNsvjcDfLrVet2/EcJu3hFMdKoNB2Bxl84aaBNFrbLRxii4tnAlwYDGIlFOF:1PNfa2McJyhqFQ84tbL7i5nSrvlF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2096	2068	rundll32.exe	30
PID 2068 wrote to memory of 2096	2068	rundll32.exe	30
PID 2068 wrote to memory of 2096	2068	rundll32.exe	30
PID 2068 wrote to memory of 2096	2068	rundll32.exe	30
PID 2068 wrote to memory of 2096	2068	rundll32.exe	30
PID 2068 wrote to memory of 2096	2068	rundll32.exe	30
PID 2068 wrote to memory of 2096	2068	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_14326_\Plugin\ffccon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_14326_\Plugin\ffccon.dll,#1
  2⤵
  PID:2096