03ee4ad26be043d788b114fc657c03c263548196527add4e4134a910a6171804

Analysis

max time kernel
87s
max time network
88s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
12-02-2024 18:28

Target

onetap v4/onetap.dll
Size

3.5MB
MD5

0f7038041baba93398b3ec5bbb12bd38
SHA1

c701722ac5a5688077a5aee3dc232d5b1922f886
SHA256

d5562a4298be2fdda7b1b74c9c5ef06c20bd8b51bbec1d622221fbb2ff81a534
SHA512

9d0a0fc52d0a3e27c3e210215ea88406da26cafb4a426e4a8ffc6cbb05ba19e6f2855fb6c185d6d379d0112c38720911afeac3e335b8672526f7657ee575aef7
SSDEEP

49152:a/jV5K7wF+KDZFRZdlBI9DW4Ftt5j/jggiQyHs3s4WxZgETqPwG2zgoN82iDPrzd:skc+KD/Iz1OHtlGCiB8FQMhW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4692 wrote to memory of 572	4692	rundll32.exe	rundll32.exe
PID 4692 wrote to memory of 572	4692	rundll32.exe	rundll32.exe
PID 4692 wrote to memory of 572	4692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\onetap v4\onetap.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\onetap v4\onetap.dll",#1
2⤵
PID:572