96e32ff5d24ed023c55e00556cedaada45db32f94229cf9d33f55a2886ac0c69

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 17:59

Target

RemoteControl.dll
Size

92KB
MD5

89b0ea5bee33a5b8786221b8d5980e9e
SHA1

b32bd36d1171c4f21f94b87b7c60ba6980b510c2
SHA256

96e32ff5d24ed023c55e00556cedaada45db32f94229cf9d33f55a2886ac0c69
SHA512

df52164cf16749a0d254b0b62d157475f2c8d11a858483cb28b5b5e4572c0a1690a7603fef993216afaa5100f226d7334e6f8155390c20fa4251449c189e3f5d
SSDEEP

1536:P2R6mlVYVWD7WCZ18TM02WxVAI5ZWLp9XZ/NZ9Nd9dltN++gJh7eIEaK/T:PsV77t8Tv2vIbWLp9XZ/NZ9Nd9dlt8+2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2524	2536	rundll32.exe	30
PID 2536 wrote to memory of 2524	2536	rundll32.exe	30
PID 2536 wrote to memory of 2524	2536	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RemoteControl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2536 -s 112
  2⤵
  PID:2524