d9d8306339ad71f6e941cdc5426ab5fefdfcfcb3cee8e54780e703d6c1e1ac77

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
07/03/2023, 21:09

Target

WorkshopDL/Modules/Archive.dll
Size

97KB
MD5

0d1416e079cc907971a7eebe49189eb1
SHA1

4e0ccfc37e738df826b526f3e7016b2c45e415cf
SHA256

c75918d99dd8983fff3dc51ea3f28ad7a9da8c84f273e5a20736f227626fb50b
SHA512

7f7cc470a74a5063f3a922d182a0e394016ac7ad97daca766ab38c63d837534df46cc4dffd88b0e5e9106e80db551568ee75dd35bb5fe22581bc2ed41a5f5d0e
SSDEEP

3072:OpZ807jkNqfPD/bQTiZoPK1Nkcm3udzss6qnMny7vOyefz+:OppjkNq/e3ctf6qnMnyDOyeL+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 5008	5092	rundll32.exe	81
PID 5092 wrote to memory of 5008	5092	rundll32.exe	81
PID 5092 wrote to memory of 5008	5092	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WorkshopDL\Modules\Archive.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WorkshopDL\Modules\Archive.dll,#1
  2⤵
  PID:5008