e864b0f3448f3031c90f369f8c52b3e8bc2790f7b97ab40a74ae79a597d213c7

Analysis

max time kernel
615s
max time network
1616s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
19/02/2024, 17:59

Target

Microsoft PID Checker/ProductKeyUtilities.dll
Size

640KB
MD5

dd485ff8fc18a871bd3f49d8daf9c7a2
SHA1

c07cb998504512e788508c88d928bcc8759d06b5
SHA256

34adb124aba32b4dcd0b20b2f5b59a8967797fd790eb8a571fdabd5636ef34ad
SHA512

5f1ac672ba82e57454970c0b7d179837be2460bf967e12045727fdf43c0681cae88864e1e24542f5e78bab14c214b4576ca86c05b7deb18332d76d0d441067cc
SSDEEP

6144:qhJkTM9UEgDjTKIHWbp+zcnqHVcZlczrHNydWq/M4gGMPxYmzBpIgfFYK1:POUE6j2SmpWcnqiwrHNV4hgv6mNpI56

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4444	5056	rundll32.exe	73
PID 5056 wrote to memory of 4444	5056	rundll32.exe	73
PID 5056 wrote to memory of 4444	5056	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Microsoft PID Checker\ProductKeyUtilities.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Microsoft PID Checker\ProductKeyUtilities.dll",#1
  2⤵
  PID:4444