5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0

Analysis

max time kernel
101s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2023 14:05

Target

portable/wx._combo.dll
Size

174KB
MD5

75e2bf22726d0f35960df2cc41650ca9
SHA1

bf163c6f8fda50efb2507b461bfaa43a004eb61e
SHA256

87aab7fd3b63cad3a0366ccb114c5651d71e30f742c1e94753baed55ca41a123
SHA512

85cc3263735ac3d2beba0764ad896d453176fa46efed22d9fbb2732233ac30d753eef1ba1b9da376b00e75d5a266a7b08c71d02345c9f7546dbdbcaf4eab00fe
SSDEEP

3072:7+KSttdSd9bSNhoKtlYCKylHMedythsPn78SSFTS2h/Syx4KgoGhpjWAdSt4NgWS:7+KSttdSd9bSNhoKtlYCKylHPdythsP/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 676	1452	rundll32.exe	82
PID 1452 wrote to memory of 676	1452	rundll32.exe	82
PID 1452 wrote to memory of 676	1452	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._combo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._combo.dll,#1
  2⤵
  PID:676