9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 02:57

Target

todolist_exe/HTMLContentControlBridge.dll
Size

54KB
MD5

6db88b783703959532759525750b4dda
SHA1

6fa5a983b049d989a424c4c799fceeaa911c4bb5
SHA256

5b9c67f216b591cf25bc61b4d90010861d77532334ce711ecbd68b0779a64901
SHA512

d9f965f68acc7decd8318e43d00bba0081d119da052c2ddd820560726f07ee57c6978f7fcbcf0919d42856f579ddc06e81956618cd9f45aebe01af53d056c9c5
SSDEEP

768:eXL45EtaYkWDpD6lG7luy2QUUw5vX6SKNz/MA43svzWZoqaVKasF/BLXJq8AYzm5:e745Et7k6W+ZFTMYLWzRZJq8AYz98r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2776	2056	rundll32.exe	27
PID 2056 wrote to memory of 2776	2056	rundll32.exe	27
PID 2056 wrote to memory of 2776	2056	rundll32.exe	27
PID 2056 wrote to memory of 2776	2056	rundll32.exe	27
PID 2056 wrote to memory of 2776	2056	rundll32.exe	27
PID 2056 wrote to memory of 2776	2056	rundll32.exe	27
PID 2056 wrote to memory of 2776	2056	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\HTMLContentControlBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\HTMLContentControlBridge.dll,#1
  2⤵
  PID:2776

memory/2776-0-0x0000000002220000-0x0000000002260000-memory.dmp

Filesize
256KB

Download
memory/2776-1-0x00000000002E0000-0x00000000002F2000-memory.dmp

Filesize
72KB

Download
memory/2776-2-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/2776-3-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download