eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:23

Target

Lenin_Script/dll/BARS.dll
Size

25KB
MD5

16967b88e1699ff881999b423a916fb9
SHA1

c614f8077e7ec04311077158b3800fe42f92d759
SHA256

b6dcb56cc9bcbfabb0a5b725ccf396c52e8e320dc1e71b5915cedb8f83cec2e6
SHA512

b63dbaa521d15480d971acc78287392fcf317e3ebb748e8bd199ba8509fb99f623428c4a23216034e466dda987b29cd9799389b4e7c6741d58f1e0fb080b71b2
SSDEEP

384:byPAKTj2P4lAMxKb+aPkXUwb/Rkcds80OZqG24hMotbP1Pfcx0GZEMy3:MAKTj2PtM0wdbG+sWQd45xXa0GmMy3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 2300	4384	rundll32.exe	87
PID 4384 wrote to memory of 2300	4384	rundll32.exe	87
PID 4384 wrote to memory of 2300	4384	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\BARS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\BARS.dll,#1
  2⤵
  PID:2300