6a0664da0332aa8f4428914ba6aff37506fd239776a881e6d24f1cf5b60cbb70

Resubmissions

24-09-2023 15:33

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2023 15:33

Target

jansson.dll
Size

359KB
MD5

94140e827a0960e4d5b00e04378526d3
SHA1

0ddb9943b4480fc769ebd2357c16dfecad319104
SHA256

3808f179810ccf44d4ad770850f132ddd8978017801a8cb6536c3221d74d6e1c
SHA512

2acef1e4e435c246f13b9001bfdc83c352fa5ec8ad7e12b93d2b81ee13d3a49229d58f74b97b062cb85d0a6c44da05862da4c71ec4be98b63630a9d8be03a088
SSDEEP

6144:AzEldF2RjxSSC2zoT+mWDD4mcSUVtNFqZltWkt4h7ipXDFEYgZ+GFffcD:5GRjxSSC2ETXM4mcSCNQZltW64qgZjM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4272 wrote to memory of 1964	4272	rundll32.exe	rundll32.exe
PID 4272 wrote to memory of 1964	4272	rundll32.exe	rundll32.exe
PID 4272 wrote to memory of 1964	4272	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jansson.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jansson.dll,#1
2⤵
PID:1964