55aa5ea3f3aea2186f963209015fe71f37244df3149661746f1aaf7545fe95fd

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 01:02

Target
XInput9_1_0.dll
Size 11KB
Sample240331-bd5q2aah2x
SHA256 4fd284d19300d6250e736585418bfbcffc06f0bb7c2af73a24818a9131a558e2
MD5 830e56208ade5317e5533599f54d05da
SHA1 fd4d925983d8193f5509931f9c8bcbbe411bee80
SHA512 676b918b73693c2d6569c68ec85617f0a5195ea46eefb6d8a8b948dbc16daf8f03207ea68c0104fa685291bccd17c5d5379d1dcbff23fc1095f9d31a2d829e41
SSDEEP 192:cQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyXaCwmPgbDLTGc:y/SspI2WgHJZlj/Xa/tvi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4488	640	rundll32.exe	87
PID 640 wrote to memory of 4488	640	rundll32.exe	87
PID 640 wrote to memory of 4488	640	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
  2⤵
  PID:4488