f9de69f500316f89884b9809943388ea1c7bab6e9164316f9e880e4bbc2fa469

Analysis

max time kernel
153s
max time network
319s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:33

Target

MiniUpdate/Xor_Plus/Settings/tga.dll
Size

54KB
MD5

48907a9fbd22ce4c93cded3fd37abdd1
SHA1

48c36e02f44e05524064934e4bf1d1474e43a320
SHA256

bab64e9fc60c0419b76f0826b6508c25204b9bc4dca872241e7625978983b095
SHA512

4dd2b7e8d6e88abfc7b8e0c2629dbd58fa1efd17d3cb71dba9940ae62098ee6d10b86ef677f552fd8baec2768c3f9f5fe9c3edea7ef3e213d60afe98649d6417
SSDEEP

768:Yx88NNxBCjNTsTlAqnin7hxkkSwZDynTEDY98xhadPv91T:ClNNahg4xkmgBdPvHT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2632 wrote to memory of 4592	2632	rundll32.exe	85
PID 2632 wrote to memory of 4592	2632	rundll32.exe	85
PID 2632 wrote to memory of 4592	2632	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiniUpdate\Xor_Plus\Settings\tga.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiniUpdate\Xor_Plus\Settings\tga.dll,#1
  2⤵
  PID:4592

memory/4592-0-0x0000000037CD0000-0x0000000037CE0000-memory.dmp

Filesize
64KB

Download
memory/4592-2-0x0000000037CD0000-0x0000000037CE0000-memory.dmp

Filesize
64KB

Download
memory/4592-3-0x0000000077CE2000-0x0000000077CE3000-memory.dmp

Filesize
4KB

Download
memory/4592-1-0x0000000077CE2000-0x0000000077CE3000-memory.dmp

Filesize
4KB

Download
memory/4592-5-0x0000000037CD0000-0x0000000037CE0000-memory.dmp

Filesize
64KB

Download
memory/4592-4-0x0000000077CE2000-0x0000000077CE3000-memory.dmp

Filesize
4KB

Download
memory/4592-6-0x0000000077CE2000-0x0000000077CE3000-memory.dmp

Filesize
4KB

Download