8d2f02a55a6957c8b8013d5df7837cbc836fa1e599d7d7eed4f1ef4a42f7fb8f

Analysis

max time kernel
167s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 05:17

Target

SnagIt 8/LTDIS12n.dll
Size

253KB
MD5

4dff6da6d4713342e0d9bde2a9d06d9d
SHA1

4784c2d1a6f492e72ac2ea9da987d30123882b81
SHA256

131cbf66e9df15cb025aa466408e3d6798fb1b9c95b4318115a72e71db2f4e5b
SHA512

e80757bee0693ed80417c35ba3233fd818dca8a954276b273180d661f74128ece889783d2ad79f5fa418869b731ca4bf7ed3b36b33d4cfdeacfbc67a529389e5
SSDEEP

6144:NXQTLuPccHHpBwnaklAZVcLDIOTAdr8luvwQAqd2dq4bW0Mms3jBwr83orIWbLIq:JQTLuPccHHpBwnaklAZVcLDIOTAdr8l1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4940	1956	rundll32.exe	89
PID 1956 wrote to memory of 4940	1956	rundll32.exe	89
PID 1956 wrote to memory of 4940	1956	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\LTDIS12n.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\LTDIS12n.dll",#1
  2⤵
  PID:4940