2113ade625c91a1da75c09c6a221abbf14b8719e9a84eecab606c612c81fa145

Analysis

max time kernel
128s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 18:47

Target

SecuriteInfo.com.not-a-virus.AdWare.AdRotator.23452.dll
Size

335KB
MD5

1abb4f95f523874cb25c660527c8514b
SHA1

df1c411703df728fced145ee38fdbbdbf612368d
SHA256

2113ade625c91a1da75c09c6a221abbf14b8719e9a84eecab606c612c81fa145
SHA512

15dfdabee27c2a2c2a1f1c9384e93366f5df8bed7dd06bf5d81155c79328e8b38e5901d9cc2cf6cf9e8ba28569349e1e64ebdc8f26d09aa1b74fcd3c6272a049
SSDEEP

6144:yHxahc2IeThI966AGkAjOpoaY7TCQ8jHzhdR5jZUZM:yHxahTIqq6xGJOpqH0HtBNUZM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4520	4608	rundll32.exe	86
PID 4608 wrote to memory of 4520	4608	rundll32.exe	86
PID 4608 wrote to memory of 4520	4608	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.AdWare.AdRotator.23452.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.AdWare.AdRotator.23452.dll,#1
  2⤵
  PID:4520

memory/4520-0-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download