e7bf5558d5445eb2f7e3d0cd4001a54281293f98230b23522f6d444afa4bc9eb

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 23:29

Target
libX11-6.dll
Size 1.2MB
Sample240227-3gywfaeb44
SHA256 497471497886f18ca16f7facab7d76dc9bfadd69deb9c6e4ea9bdc0869a15628
MD5 3cd9af46753f2a618d15157372d0d2bc
SHA1 f2a1781b1a6d33338db4d9725b28f15d8a410903
SHA512 925097106554f6eac698ba933e32fb82c1405c7ccfe284b27f1558e9ab46139506b1e981721aeafaf2e0d595dbdfce3587c4056c6920fdffb0b2f2bdbdcdb38d
SSDEEP 24576:uA7S97BMxq0REUm75horlhVwwf7JtdVrd:ud9VMxq0REUm7IrlhVd7d
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3592	3916	rundll32.exe	86
PID 3916 wrote to memory of 3592	3916	rundll32.exe	86
PID 3916 wrote to memory of 3592	3916	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libX11-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libX11-6.dll,#1
  2⤵
  PID:3592

memory/3592-0-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download

memory/3592-1-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download