5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:31

Target
WinIo.dll
Size 12KB
Sample240213-2ffg2aae9z
SHA256 e2f3e20bbb6379bf04028d69c5d250d8d01d7c7714cbe6e24132a0ddd2db15c4
MD5 194062d46bbbb73aac4207507b330a35
SHA1 7dc3fbbacd4d66415b9b1b21860a3a9d0e31710b
SHA512 3f6e58ef02f41245ffbc67196a981e6641a7629f1815c1137c6fe06a5f8a5aa26db6eee520921739700f8e4ba162c7aa555529e60bfaefb7b7c88c118c90b84b
SSDEEP 192:t2RLjWzDNeEsrpGRIZKCVp6TzNjRz1ivxEpiEq:tYjWz+uMlVwnP1xi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2600	452	rundll32.exe	67
PID 452 wrote to memory of 2600	452	rundll32.exe	67
PID 452 wrote to memory of 2600	452	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WinIo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WinIo.dll,#1
  2⤵
  PID:2600

memory/2600-0-0x0000000010000000-0x000000001000C000-memory.dmp

Download