d2163c67dcbe2bee19fc53966ef331d300516e769339ae460daf5130243742ff

Analysis

max time kernel
118s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2023, 17:31

Target

SecuriteInfo.com.Variant.Barys.431180.31317.dll
Size

5KB
MD5

0ca58b2cb85a90d2ce58e748b43770a8
SHA1

3d417a0927f9aed78d6b22aa42c8833bdc380e11
SHA256

d2163c67dcbe2bee19fc53966ef331d300516e769339ae460daf5130243742ff
SHA512

6a54968fd7cccdf3586ae67d0b1bebedcc7ed350c56c0ed59e87be9f868d58a9a422fee880a557f647e9ada84b69d816de66007488237e980cfc52212123d83f
SSDEEP

48:iAMHijql4r6tMCKipDd7ZgF+hp4YA/aldDd7x9S8P9+pu4NeXiF8hiQ/55y:prh05Ay7hjl+p7eXiE5/5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 868	3456	rundll32.exe	83
PID 3456 wrote to memory of 868	3456	rundll32.exe	83
PID 3456 wrote to memory of 868	3456	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.431180.31317.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.431180.31317.dll,#1
  2⤵
  PID:868