2a198f370ff2d9c2afbec879a0dc84d1d60f59077178c67bff6a5f4b4210be8f

Analysis

max time kernel
145s
max time network
280s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
12/01/2024, 15:30

Target

Setting File/Setting File/Ordinary model-mini keyboard English setting software(Compatible with all�.dll
Size

21KB
MD5

7c2c0941308ff5425267c2d6cdba14b2
SHA1

f1792e4899022d3326768a677805200736d3b59e
SHA256

d3bb610810b1c8f340ab496980718672140eab6ce3a018ff98493a01339ed0df
SHA512

2070bcfe5cdb73707232fa3628f69201529de70d9d48e2aa525dfbb32cb39dd3d54b6857e87424223fc0b12dbaf0e098ffceb2cb71348ff5424187661a51a30a
SSDEEP

384:/pXwWwq0cKllNHwkawjXwykTEA3vPzmmz/GSwqS8Tm1Awf2wqhwqS8Tm1Awfqwq7:uFEu9gqxKjFiy6rtx3YGYH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4184	1016	rundll32.exe	81
PID 1016 wrote to memory of 4184	1016	rundll32.exe	81
PID 1016 wrote to memory of 4184	1016	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Setting File\Setting File\Ordinary model-mini keyboard English setting software(Compatible with all�.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Setting File\Setting File\Ordinary model-mini keyboard English setting software(Compatible with all�.dll",#1
  2⤵
  PID:4184