fbb8b1628ac703a3eebff4b630b7d0b4a268cf46c8b7871436bbb448f55f56ec

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2023, 02:28

Target

SecuriteInfo.com.Win32.PWSX-gen.4552.23262.dll
Size

83KB
MD5

4f7296f6ddf70e41127be41bf709e087
SHA1

6246f7f3f93b05437d5aa9dda2f2438d94e1acc8
SHA256

fbb8b1628ac703a3eebff4b630b7d0b4a268cf46c8b7871436bbb448f55f56ec
SHA512

543987670da6501df558c57bb38fa89955c2358203e571264b22bf6359418a588e98587bb7bf60b31c7e5dfb0ae0c9c13bd0b868f4e688236a67ebab166852dd
SSDEEP

1536:MKClgUpX66yqljKvuaXuDEPXIJfbuVH5sWzcdkRFjTtB4sgtcu:Mhd66yOjKvtuDEPXkW2kfv/4sgtcu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 3724	948	rundll32.exe	85
PID 948 wrote to memory of 3724	948	rundll32.exe	85
PID 948 wrote to memory of 3724	948	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.4552.23262.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.4552.23262.dll,#1
  2⤵
  PID:3724