c8d459b37ed4ae108b5590edec6cf9683f5cb0ad2201783e576865b8c1b79dad

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2024 23:26

Target

CONECTAR MANDO PS3/CABLE/x86/dshidmini.dll
Size

187KB
MD5

f253751170a0342184fb57e55ca15187
SHA1

0b781c626e2ed15471fad85e3a9da7bad565f885
SHA256

5c3ccf0daeb74c4148b2db3c2a321538a5406a41c87eba06a4e5c0aef13a1661
SHA512

edcffdc75f59fe891fee71ec2aa76c83ba2103107a906e44fcfbd8a913828a26349ea45995385488e534389ab3795990aa0b137f57d9fd2440e278b7749d29b2
SSDEEP

3072:zzvRsPLQQwRYVKoITBiVN+TZMHqc1WY5lp1uWF9nN4I9a3Ru2vVC00Rs:z9sT6RYVKoCBiVwelTNRKRdYns

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 4600	804	rundll32.exe	85
PID 804 wrote to memory of 4600	804	rundll32.exe	85
PID 804 wrote to memory of 4600	804	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONECTAR MANDO PS3\CABLE\x86\dshidmini.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONECTAR MANDO PS3\CABLE\x86\dshidmini.dll",#1
  2⤵
  PID:4600