be68c54bf25595d493a529c7f64ea38629b44f07c4551c208752b0b57060e2ae

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 22:07

Target

ROIntegration.dll
Size

697KB
MD5

fa958546404323c023d0171a90c4689b
SHA1

1c765a9f59b89cbd3015ed171ca65134fa7941ba
SHA256

2c107c82ab4a63b6280f85396183940ff0fdd88f8c3013263fc1804dd8cb7e18
SHA512

23bf9bf0ffa8df83f491add0479562fbce219b2bfde4ce30929c0d63ea7d84a691b1999cac8a7c9d49c4593743ebe5a4cb3f98ea089eeea613f4aabc4645085f
SSDEEP

12288:c/qsoRf3QMb7aDdEVtM9wzbeFp5bcP8oVCJHsu7ueyaYzIN888888888888W888c:c/qzRf3QMb7aZAtM9wzbkpHlII87

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4628	4052	rundll32.exe	86
PID 4052 wrote to memory of 4628	4052	rundll32.exe	86
PID 4052 wrote to memory of 4628	4052	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ROIntegration.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ROIntegration.dll,#1
  2⤵
  PID:4628

memory/4628-0-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download