5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0

Analysis

max time kernel
82s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 14:05

Target

portable/wx._windows_.dll
Size

797KB
MD5

98566a15d4d5a95c7490e5b0fe11fb43
SHA1

e0f2b0dc93396e6616b09b391c4658d0bb6a5a58
SHA256

c21d6096a7aaa0ec8bf39ebe97c8e365e57b24717a13ba88e8e42f5625257549
SHA512

dad5566d6252a344eba654b001b3349bda7759a93a7515e8ed55e47b8c88ddfe65198ef139b63c669b419e15ffea9bc6ee0ac5f899542e84166b24c09c2db6ff
SSDEEP

6144:5GSP3XepvKqY3nwyTQQD8PDzXQ2ysSDY3TmFGZ1SmakETALtPu9B4yT0kuTpQV7L:5BvXe0qY3nwyTQQD8PPFiUanpKCGG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3800	4644	rundll32.exe	83
PID 4644 wrote to memory of 3800	4644	rundll32.exe	83
PID 4644 wrote to memory of 3800	4644	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._windows_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._windows_.dll,#1
  2⤵
  PID:3800