3154f0fa40afa43b9c106c6c7d4c2ba01232053b9087e5fd8348a84e385a3cd3

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2023 09:35

Target

SecuriteInfo.com.Trojan.Win32.Antavka.24067.dll
Size

212KB
MD5

f838980b44a056f52f28244549af77c7
SHA1

343f7ac119056c5a896e5b72ce9398217c619d63
SHA256

3154f0fa40afa43b9c106c6c7d4c2ba01232053b9087e5fd8348a84e385a3cd3
SHA512

4f2997f04ed557ed34f2be70251594071b1e477cbbfd9abb163887f8627f991062ae3277850f5ba8126cdbb98ef341ce4f78112d3aab6ec53d996f4a9ab2e718
SSDEEP

3072:c/+qf0FPZKbdueFw/p2pfZpEpQJOnkVi2p5aKvtdwvTyJ5C:s3fwZKbdNFnpfHEi/0GpnwS8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3196	1104	rundll32.exe	86
PID 1104 wrote to memory of 3196	1104	rundll32.exe	86
PID 1104 wrote to memory of 3196	1104	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Antavka.24067.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Antavka.24067.dll,#1
  2⤵
  PID:3196

memory/3196-0-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download