3c98ead4523e58fa993215b0536711d1e8d99be715b1f62855a3b39a0d879d8b

Analysis

max time kernel
166s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:47

Target

51Logon/dll/msimg32.dll
Size

28KB
MD5

3c1041053e2c9cd9620b58c0527f9a87
SHA1

327624202bc77c473994fd89568c8ccbed23a97f
SHA256

3b6a394adad69e170cedc53892f9999e0fd756c3578e506fb5eba8614dd5bd2d
SHA512

3b2d640f1f2093d288a27274a2962709cc2ec7bad43f52f1f3c061baa9744fde8143f465090867299e24f5ec2160de906ecfb7c5f345b7825038467f2ea7707a
SSDEEP

384:HbVPsjDZNpi8hIUImMQ+I4KunHu6oeK74V0KNu0mbr3vcDRH/xwFAxAr6+e9Pfq5:RPsi8iUII85oeVvN6HEDrw+xnha5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4388	1196	rundll32.exe	15
PID 1196 wrote to memory of 4388	1196	rundll32.exe	15
PID 1196 wrote to memory of 4388	1196	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51Logon\dll\msimg32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51Logon\dll\msimg32.dll,#1
  2⤵
  PID:4388

memory/4388-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download