151adab32ef2ff5ab351a4b933b067c72c967dd5aa86c6d260338d953afeb5fe

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2022 10:26

Target

language/de/IPVanish.resources.dll
Size

7KB
MD5

8f41105d6f33dfcf371d48f3bee7e7b2
SHA1

b9cf01d7f16b19844268d74562dfc40429fafc0e
SHA256

44a55e777f336358b57ab405c7b971d3c83a3614bd4656e5c6104741b726e9ee
SHA512

35a8e5023587c8a089cf036a4b8bedca6f4ad990b0defc16a3a33073fa220eb5e9f687a0eb6752e85c0cd2c514032ebb5821e349578f3fa9ad9bc67a12e3e904
SSDEEP

96:Jkwo4TMC08TKQn1et1gSRwLBcWPbBs2/46S6Kqi0glkZXzz+:Jkwo4BN1igSRwLBcGbBsv6S5+Zzz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 4476	648	rundll32.exe	83
PID 648 wrote to memory of 4476	648	rundll32.exe	83
PID 648 wrote to memory of 4476	648	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\language\de\IPVanish.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\language\de\IPVanish.resources.dll,#1
  2⤵
  PID:4476