9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31-08-2023 02:57

Target

todolist_exe/DayViewUIExtensionBridge.dll
Size

57KB
MD5

5c075f7c25241d9f70fe264517cd3467
SHA1

30d991ecfeff26a4307e1e9b8d89bc81c87717f1
SHA256

11c43eb7165e902500a09ed59d5e5763ce9b83af6a18a12e00aebf9fdcf55020
SHA512

1f7d8c845df26ad3a82336dce4c0cdacb8b4c8c856ebdebb6287b05be73f8a5d1138efd88a2aadb0e0c830368316db42493a5c837410655cb7f7687603ba7187
SSDEEP

768:QdjfUyw8kUT+Is0ViFebTuAdO+SOa5QDVpEX1/r2doIIPE0/O2/6CL3KY2VIlyQc:6UyhkZ4ACEl/icPEZjY2V4V8qDqT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2980	2292	rundll32.exe	27
PID 2292 wrote to memory of 2980	2292	rundll32.exe	27
PID 2292 wrote to memory of 2980	2292	rundll32.exe	27
PID 2292 wrote to memory of 2980	2292	rundll32.exe	27
PID 2292 wrote to memory of 2980	2292	rundll32.exe	27
PID 2292 wrote to memory of 2980	2292	rundll32.exe	27
PID 2292 wrote to memory of 2980	2292	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\DayViewUIExtensionBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\DayViewUIExtensionBridge.dll,#1
  2⤵
  PID:2980

memory/2980-0-0x00000000005D0000-0x0000000000610000-memory.dmp

Filesize
256KB

Download
memory/2980-1-0x00000000003D0000-0x00000000003E3000-memory.dmp

Filesize
76KB

Download
memory/2980-2-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-3-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download