c8d459b37ed4ae108b5590edec6cf9683f5cb0ad2201783e576865b8c1b79dad

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 23:26

Target

CONECTAR MANDO PS3/CABLE/x86/dshidmini/dshidmini.dll
Size

192KB
MD5

27df9dbde6c836012dfc0701e4266a2e
SHA1

0e2e4a716702d8ca99ab3297e8031d8d9c891957
SHA256

df5a3f739d459977015931aa94d096a0146805abc08c2f0b643d9f8456156de7
SHA512

f00078d76cb9f8f326569cc662860a539f8b01ae9b2cbcf96d4b220be3651c63aee35a16730d4dbddfc8409a4a8503ef01b044102d48860a2d72081345e473f0
SSDEEP

3072:1zvRsPLQQwRYVKoITBiVN+TZMHqc1WY5lp1uWF9nN4I9a3Ru2vVC00:19sT6RYVKoCBiVwelTNRKRdY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 5116	3212	rundll32.exe	85
PID 3212 wrote to memory of 5116	3212	rundll32.exe	85
PID 3212 wrote to memory of 5116	3212	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONECTAR MANDO PS3\CABLE\x86\dshidmini\dshidmini.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CONECTAR MANDO PS3\CABLE\x86\dshidmini\dshidmini.dll",#1
  2⤵
  PID:5116