15b8ea286ec25a55cfba25409a30533ce8026ba440eff6234b121f5b1fb37adb

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2023 18:46

Target

Best Instagram Bot 4.1/Application Files/Best Instagram Bot 4.1.application
Size

5KB
MD5

3ae5c66ad2af2b9f6ef27763b0c2ddcd
SHA1

8bb98ba2348db443475bf01333f75998fc87e043
SHA256

dd7da4fa2830a6edad8c138b1c05fe246bf9f008d1deeb1005698658bb58d0a2
SHA512

5f186a860b9657f115df3afa73940ce6d3b92cab5c7a579393fcd1e612b74ddc96d6355cd0a8a85c1880e856c7e61dd722cdbd8ad8bd7d532804c700dcc62dfe
SSDEEP

96:xWtZcb1jZxACICbNT2BQSk3cglUFmO3MxajBEknFdLAaBDA:ogZ3cgiZjnX0cA

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2348	2580	rundll32.exe	84
PID 2580 wrote to memory of 2348	2580	rundll32.exe	84

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication "C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\Application Files\Best Instagram Bot 4.1.application"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:2348

memory/2348-133-0x0000014466700000-0x0000014466708000-memory.dmp

Filesize
32KB

Download
memory/2348-134-0x0000014468C30000-0x0000014468DB6000-memory.dmp

Filesize
1.5MB

Download
memory/2348-136-0x0000014468BC0000-0x0000014468BD0000-memory.dmp

Filesize
64KB

Download
memory/2348-137-0x0000014468BC0000-0x0000014468BD0000-memory.dmp

Filesize
64KB

Download
memory/2348-139-0x0000014468BC0000-0x0000014468BD0000-memory.dmp

Filesize
64KB

Download
memory/2348-140-0x0000014468BC0000-0x0000014468BD0000-memory.dmp

Filesize
64KB

Download