36f4a643b55ba7dcba92c8a8e1ef5f05bf2acc1d866ea1d8752a926f848cca44

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 20:03

Target

bugfire/withInstaDefuseandNoWepChange.dll
Size

303KB
MD5

a4860c8dcb95d1e655d9e3b1887718e3
SHA1

36d1b3562720a61db20fb67850ddb863fb4811c3
SHA256

ff045c3b2a01b35dc6d39e05c233b4d8b5603a3e1411ee9408ccd968ff7808dd
SHA512

852ea7e248e2dc7c5f2365638070ec83a4fd267fd12b7781a43e501ed4231d7fe73262aa3aaa78c3186feab2097b231344a3b6227042a5e99c65670e2f663453
SSDEEP

6144:wuqctITXxcZcyGUtvNJNI9iiYDh2i888888888888W88888888888:DOQcyRXCdYDhF888888888888W88888P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1080	544	rundll32.exe	82
PID 544 wrote to memory of 1080	544	rundll32.exe	82
PID 544 wrote to memory of 1080	544	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bugfire\withInstaDefuseandNoWepChange.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bugfire\withInstaDefuseandNoWepChange.dll,#1
  2⤵
  PID:1080

memory/1080-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download