413cf6a694eef7a4f1725a11938f1ab2df1957bfb3bf20cf6a47017bebbad2a9

Analysis

max time kernel
91s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 09:51

Target
ursnif_unpacked.bin.dll
Size 43KB
Sample231220-lvgqmsgdaq
SHA256 413cf6a694eef7a4f1725a11938f1ab2df1957bfb3bf20cf6a47017bebbad2a9
MD5 798d5713512b5cb6228138ceea7c8066
SHA1 aa9197b154d0cf0ae1867e2b7befe56030c8609f
SHA512 b6c55a1a4f79dab387636b0214528baa833bb71faf55218380bb308d53e617e5be7cafbe40c2aa5eda60122a37578fdc51c2c9af7c98fd81a4df2188be17c79b
SSDEEP 768:nmEpMZSMa44sl1paFt5XJ2Wt8W2rsbdcOJNm17g40NxWhTL:njMZSJ44Nt5XJ2WuWCWcOJM17YCTL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 5024	892	rundll32.exe	51
PID 892 wrote to memory of 5024	892	rundll32.exe	51
PID 892 wrote to memory of 5024	892	rundll32.exe	51

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ursnif_unpacked.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ursnif_unpacked.bin.dll,#1
  2⤵
  PID:5024