21bd81468524637ded24a3d2ef3e9ccafb8cde6cf01031bff89097a66cc4cbf7

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 03:56

Target

AutoReply/FeatherskyW.dll
Size

36KB
MD5

0d112233b172604cd372192a84d66628
SHA1

865599a813014a4208927ca398e79672ea532933
SHA256

b17817ad517702c34406b8e860d2dda48d3510c1a86a5673b533ac9121acae1a
SHA512

39312e103dbfa0f312ac7a67004c517dd991a83f2fecfdca3ce9a7bde0dcd19e0a6d58cd8e2f7d046f2a250f28cc67267819e6696da9ca339f5b67fde6def75f
SSDEEP

384:Dv4CpwrzjkzXAmTVzm+qqml0INoYvxyMAef0e3skKjvXoLFGPvFuUO:z4ZQ8mTVa+tuvx+ef0eckeXoL/U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1228	2784	rundll32.exe	83
PID 2784 wrote to memory of 1228	2784	rundll32.exe	83
PID 2784 wrote to memory of 1228	2784	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoReply\FeatherskyW.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoReply\FeatherskyW.dll,#1
  2⤵
  PID:1228