9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 02:57

Target

todolist_exe/GanttChartExt.dll
Size

436KB
MD5

d9c018c1c68db005c4dc270feacb867d
SHA1

fd3d059b78aafcb5e9e059d92ecb5be460e420ce
SHA256

15adeaf417fa0e85bf8a8eab37029ed22b3c1721b8b6cec589d35e305007a697
SHA512

5fe49f0a827bd036662a1e6844f85364ded40a593747a8aa5b017bda61b6d6b8d08c7fced560a9c61ff48d2f848ed033fd55298f29c2f5f54c5d66cbf07f6a89
SSDEEP

6144:wIoK43YUDXgl3t71fbb3Ace67Jb08oz9++3p+2RXCS09HS/PRpURS+8IzTavK:DMvDXglDDbAcN7Z0zf3xA+/PIJzoK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2548	4808	rundll32.exe	80
PID 4808 wrote to memory of 2548	4808	rundll32.exe	80
PID 4808 wrote to memory of 2548	4808	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\GanttChartExt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\GanttChartExt.dll,#1
  2⤵
  PID:2548