797e52d61827ac81a4528d8ae01e56a96b26941954d644ddfa009a1a6e179fd8

Analysis

max time kernel
141s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
28-03-2024 16:52

Target

miflash_unlock-en-6.5.224.28/pdf.dll
Size

8.5MB
MD5

855bf6db78b181d8060decb45dcae2ae
SHA1

7d4cb7fd908ebebc77432d3ac7747cfb1ac290a6
SHA256

8285978bfed5100994a6bb5c3997a27e265124a63c0638a0d83e9dd594506503
SHA512

f5635ffd86ced3e449e9f7bbbf056beb08f7aebc2fe615df561a16c9ea5b36020e4dc9afab30ca50b0b8fe0669662181f94ee2a7558d035303280638597fa939
SSDEEP

196608:DfpRqwHS/Z7WvRSL8JZEUsLACYCep2gjyj3q4P:DpR3Hi5CRQ8JZEyPnjjyj3qk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3080	2220	rundll32.exe	80
PID 2220 wrote to memory of 3080	2220	rundll32.exe	80
PID 2220 wrote to memory of 3080	2220	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\pdf.dll,#1
  2⤵
  PID:3080