9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab

Analysis

max time kernel
130s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 02:57

Target

todolist_exe/HTMLContentControlBridge.dll
Size

54KB
MD5

6db88b783703959532759525750b4dda
SHA1

6fa5a983b049d989a424c4c799fceeaa911c4bb5
SHA256

5b9c67f216b591cf25bc61b4d90010861d77532334ce711ecbd68b0779a64901
SHA512

d9f965f68acc7decd8318e43d00bba0081d119da052c2ddd820560726f07ee57c6978f7fcbcf0919d42856f579ddc06e81956618cd9f45aebe01af53d056c9c5
SSDEEP

768:eXL45EtaYkWDpD6lG7luy2QUUw5vX6SKNz/MA43svzWZoqaVKasF/BLXJq8AYzm5:e745Et7k6W+ZFTMYLWzRZJq8AYz98r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1212	2960	rundll32.exe	81
PID 2960 wrote to memory of 1212	2960	rundll32.exe	81
PID 2960 wrote to memory of 1212	2960	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\HTMLContentControlBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\HTMLContentControlBridge.dll,#1
  2⤵
  PID:1212

memory/1212-0-0x0000000000D20000-0x0000000000D30000-memory.dmp

Filesize
64KB

Download
memory/1212-1-0x0000000074C00000-0x0000000074C12000-memory.dmp

Filesize
72KB

Download
memory/1212-2-0x00000000742A0000-0x0000000074A50000-memory.dmp

Filesize
7.7MB

Download
memory/1212-4-0x00000000742A0000-0x0000000074A50000-memory.dmp

Filesize
7.7MB

Download