9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 02:57

Target

todolist_exe/DayViewUIExtensionBridge.dll
Size

57KB
MD5

5c075f7c25241d9f70fe264517cd3467
SHA1

30d991ecfeff26a4307e1e9b8d89bc81c87717f1
SHA256

11c43eb7165e902500a09ed59d5e5763ce9b83af6a18a12e00aebf9fdcf55020
SHA512

1f7d8c845df26ad3a82336dce4c0cdacb8b4c8c856ebdebb6287b05be73f8a5d1138efd88a2aadb0e0c830368316db42493a5c837410655cb7f7687603ba7187
SSDEEP

768:QdjfUyw8kUT+Is0ViFebTuAdO+SOa5QDVpEX1/r2doIIPE0/O2/6CL3KY2VIlyQc:6UyhkZ4ACEl/icPEZjY2V4V8qDqT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 1324	208	rundll32.exe	82
PID 208 wrote to memory of 1324	208	rundll32.exe	82
PID 208 wrote to memory of 1324	208	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\DayViewUIExtensionBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\DayViewUIExtensionBridge.dll,#1
  2⤵
  PID:1324

memory/1324-0-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/1324-1-0x00000000753C0000-0x00000000753D3000-memory.dmp

Filesize
76KB

Download
memory/1324-2-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download
memory/1324-4-0x0000000074A60000-0x0000000075210000-memory.dmp

Filesize
7.7MB

Download