8d2f02a55a6957c8b8013d5df7837cbc836fa1e599d7d7eed4f1ef4a42f7fb8f

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 05:17

Target

SnagIt 8/Lfpng12n.dll
Size

177KB
MD5

6f3495f4a3f0ea6e1979b0d50d5a2860
SHA1

b5f60759085a99b51d808b914752c6db040c3f2a
SHA256

851db9279bb38ed0a490f32a6f00835c930b498f27dc69a79a74d05ae4b818b4
SHA512

d0f9fe139bf5c3edae714b2dc63f89a8ae60553502e1dfe7d09770312bf1ef0c04cbeca762723d586737d36c272414434b5e06524e3367fffc7559cd7ee01f41
SSDEEP

3072:fUG+z6fUixCY/iXdhR9Z7CsVhxEtA2occmnDgpjTuLaVFTWjonGRgAe:MFeCDNhR9Z7CsVhxEtAjcc+Dgp/uLaV9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1628	3312	rundll32.exe	87
PID 3312 wrote to memory of 1628	3312	rundll32.exe	87
PID 3312 wrote to memory of 1628	3312	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\Lfpng12n.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\Lfpng12n.dll",#1
  2⤵
  PID:1628