8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 16:42

Target

scripts/wHud.dll
Size

22KB
MD5

dd13a3e77c054a666334c0857e56f1bf
SHA1

dbac25feab9c470d1f1c46e188a8514c0f0a34fe
SHA256

ddaef7ec4ab30b5915860cb22cfbf777cdea7bcef326e0e13444f55b70956d3d
SHA512

448f2796ff566cc5448c6130c94531332dcf5fbe647b0f03b7fea745dce0a4aa640e25083a5f7bdc834d141441b3187b84e0d1c35562eebf54d172b35a686f35
SSDEEP

384:CRtRrrZ5gMuAvNqaplssa8649nS+QeSnTvg6WONineZkBjjs39tchTOssri:KnfgM5na860hQXtnZkBjjm6sW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4216	2616	rundll32.exe	86
PID 2616 wrote to memory of 4216	2616	rundll32.exe	86
PID 2616 wrote to memory of 4216	2616	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wHud.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wHud.dll,#1
  2⤵
  PID:4216