cddc7c774570b556d8d391203f8084e97850f3cee8a482a0c36ea74de348da2f

Analysis

max time kernel
126s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
23/07/2023, 22:52

Target

languages/en_XM/WDDriveAPI - Copy (2).dll
Size

14KB
MD5

9b22938aa2d9eb4c511fde09fcaf0834
SHA1

605838603dac1aeb29a8a7467d8f8f66c5a0bf36
SHA256

4e6938462e85aa7df2f63010aa71ba4fa4ac208f829060d18e64e42aa7a64f63
SHA512

08545361e0b1475eda73534d07d8e7de6f6995d838f680c3892adfe2bb2bbf183e34525e539806aea7e5b854c5465e56a8e09eb091a0ff4db0bc6f019228d9d9
SSDEEP

192:X4LOwvkYBhefwg2TM+oqETbUwOnYe+PjPPrIztB+vvtr9ZCspE+TMgrS0gx:vwvkgzPM+o9OnYPLExZeM9x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4132	4028	rundll32.exe	69
PID 4028 wrote to memory of 4132	4028	rundll32.exe	69
PID 4028 wrote to memory of 4132	4028	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\languages\en_XM\WDDriveAPI - Copy (2).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\languages\en_XM\WDDriveAPI - Copy (2).dll",#1
  2⤵
  PID:4132