17c6a205c9fd120e315efc82fb8e00ea2651e4b1062770b1e0c260f79d2e6a73

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 18:47

Target

Tornado_Redux_Velox_v9_Version_2010/007.dll
Size

2.7MB
MD5

95019c74e6716889f2142b5dc7e445ea
SHA1

4a5001a6f142dbf0afee50e640dbdb31e33dc7d6
SHA256

8397c035d6b39d427021df6a54e16f3cf7cd80366402820d1e959765784b3d1a
SHA512

3c67ec31510da5ca8a7060d68e7e1b4b2358a2efa0915f16262d2c29655eb619e134ac5328d129e9765f8a58c0bb0df318733c30cfe39a1a6bf9a903829b8f69
SSDEEP

12288:C9EqGieYv60Pd/va3SJmNw1c2obY73Mm4pB/UPV:CUieYxQSECoczMm4X/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3600	4600	rundll32.exe	85
PID 4600 wrote to memory of 3600	4600	rundll32.exe	85
PID 4600 wrote to memory of 3600	4600	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tornado_Redux_Velox_v9_Version_2010\007.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tornado_Redux_Velox_v9_Version_2010\007.dll,#1
  2⤵
  PID:3600

memory/3600-0-0x0000000010000000-0x00000000102AC000-memory.dmp

Filesize
2.7MB

Download