e356479c4d826f0b518d8b91b5e7ae1bd5336efc47e8b6ba9b9b8ef604a785c5

Analysis

max time kernel
131s
max time network
139s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
28-02-2024 10:46

Target

Device/HarddiskVolume4/Users/alhoulii/Desktop/Kaba/B-COMM Java/Enroll/Senro/MorphoKit_FVP.dll
Size

788KB
MD5

0cfa646995b3b3c80da1a1206f5e48a4
SHA1

c26572a061620bf20b8a1563d8e609f27d094292
SHA256

97142456e68e5c6a765a19026087522dff12a4dfe1532f45b5765b15b581d5fa
SHA512

03da4ae51e4485bdd1bd133cb9bd7e632c11d248f1ded321073dc894a25ad1eff3c76c423902b85ede809eed76625af46fe6082759d82a925eb12ee09e8b3c3d
SSDEEP

12288:kOi0uDRsDmxSyM547niVFHbGxNty434qcz7wi3bh8vrTJYKMUbawtP/saz:hi0ubxvqDXHbGDg434dwgSnWrwtn9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4716	4312	rundll32.exe	73
PID 4312 wrote to memory of 4716	4312	rundll32.exe	73
PID 4312 wrote to memory of 4716	4312	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\Users\alhoulii\Desktop\Kaba\B-COMM Java\Enroll\Senro\MorphoKit_FVP.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\Users\alhoulii\Desktop\Kaba\B-COMM Java\Enroll\Senro\MorphoKit_FVP.dll",#1
  2⤵
  PID:4716

memory/4716-0-0x0000000010000000-0x00000000101C7000-memory.dmp

Filesize
1.8MB

Download