f0abfb027d63fdf4f985107d1e17368fec5ee37fa06ebe6d08434811ae167884

Analysis

max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2023 02:28

Target

SecuriteInfo.com.Win32.PUP-gen.3977.14515.dll
Size

898KB
MD5

7f7e80f8acb574f83a439cb753b49ab9
SHA1

b328ba60ba951114a826a52281438d84a77beda0
SHA256

f0abfb027d63fdf4f985107d1e17368fec5ee37fa06ebe6d08434811ae167884
SHA512

3e68e5bb716254d26053d9414cfcf8ad843de894d5008b451e0d8630e191bca222f61b58152a9d91f790b4e281949627f049ce2a1b520af280267c1e83ee9bb2
SSDEEP

12288:9e95CVIEGpzK6FSkFvC1ZslH4yqEQCOTyiJCCTSC+ShNdU/KUJ:kC65pzvmalH4ycCYC16PdsKE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4004 wrote to memory of 4644	4004	rundll32.exe	rundll32.exe
PID 4004 wrote to memory of 4644	4004	rundll32.exe	rundll32.exe
PID 4004 wrote to memory of 4644	4004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PUP-gen.3977.14515.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PUP-gen.3977.14515.dll,#1
2⤵
PID:4644

memory/4644-133-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download