6bb390bddaaff3e75a6a2b1ecafa3f49bf6e4d93747302a6870698fb26285a32

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 20:50

Target

MiLoginTool/libEGL.dll
Size

346KB
MD5

cf78a952e22c69130eeb60a1fa726bdf
SHA1

668bb991364009598d4cc0a9b61657fcf84621a8
SHA256

a8e16173ae6e8f0e922ad418a7b2e4fb49eb6565e0fad532f42a790bc5d5597e
SHA512

d5c62d9e8ed9dee0848419dd252d9b4d7203b87e7ad2589f0dcf53536e52effac6ae6df70d2c10c881b3c6d1b1d3d18bf4011f487240bc62b311dd705a6e805a
SSDEEP

6144:PHNx9cfIcqB5HsMofnaHt0Fmq+/QM6sJhQj6nV/Gu/0yvHCLM:PH/9KIcs5MnfnaHtYM6sJ2YMu/0y0M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1100	856	rundll32.exe	88
PID 856 wrote to memory of 1100	856	rundll32.exe	88
PID 856 wrote to memory of 1100	856	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiLoginTool\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiLoginTool\libEGL.dll,#1
  2⤵
  PID:1100