233d86a0812a455dcc3f160895848afc121b9edf5a60994e716c717a5f53ee8d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 06:27

Target

PrsPls ByDerek107/regexp.dll
Size

195KB
MD5

b666988f499079339eabb094fbd37394
SHA1

9d672723cf711aad16e267ab662fca8a238d3b99
SHA256

8d3d324edca8d5a8cd9c3395b314645b2836b94ba14409670edcc731159753cf
SHA512

6d1545ef1e3720b5a3875d2cd3bd373da5652b94632ce0c44e59ca09f4d783ce6ebae96635d2bce538711b8d381a614a98afadeb15444befe32fed812b85bd2a
SSDEEP

3072:1DVO6uNHihg+6WKov/MBB8Lm4EI+0XF8wKKeHnub/6Vk6:vQNHihg+6WKq/MBBol+0XFKHn06

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1780	2992	rundll32.exe	91
PID 2992 wrote to memory of 1780	2992	rundll32.exe	91
PID 2992 wrote to memory of 1780	2992	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\PrsPls ByDerek107\regexp.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\PrsPls ByDerek107\regexp.dll",#1
  2⤵
  PID:1780