4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 05:47

Target

$PROGRAM_FILES_COMMON/Borland Shared/BDE/iddao32.dll
Size

632KB
MD5

f96d311b9a437035e7837f1c047c8eaa
SHA1

384ee1dc593b7156f638f2044740bf715c75f924
SHA256

88d1aa5f375c9a1c5aa1ea1486cc9ff2ac63fadc85b5992ae0b212be816b43cf
SHA512

836be316ff449c86ab785e7665d3b0f4bf981ece91c46b3533242aa545784147e35aba37ec4dcaffa182912a855b083004abc820b52225cbade9d1a42b651adf
SSDEEP

12288:E4vhj2+vb9+w4PaLf13tgcWJhxSXdcWW+8N:Eihj2Ob9pHp3+cECK9N

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3676	1964	rundll32.exe	86
PID 1964 wrote to memory of 3676	1964	rundll32.exe	86
PID 1964 wrote to memory of 3676	1964	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\iddao32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\iddao32.dll",#1
  2⤵
  PID:3676

memory/3676-0-0x000000004E5E0000-0x000000004E688000-memory.dmp

Filesize
672KB

Download
memory/3676-1-0x000000004BDE0000-0x000000004BE7A000-memory.dmp

Filesize
616KB

Download