27f31860fd9f2a5b127f0d13972cd0a9d3f589a9add6fa0d7feac606f2a7cb5b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 03:51

Target
russian.dll
Size 124KB
Sample240408-eepyraga24
SHA256 9900a23bf7d7f4b5e9343b6f37a8406ddeb302ebe1d9fcf382b1c408b7dc36e7
MD5 f8d4f0bc57b49287b04ed40a4c68d2ea
SHA1 9d38d930eeaa710ef1ad6da16456563d3b008b4f
SHA512 1c02fde05d653e187371b1757616173b6278f7447ec18f1103be76daa5868f70dc67b5e1a35faaddae6f6c0ecdafcf6ab9c23ecb849757764cb8fec96b3f60ea
SSDEEP 1536:IH1COcV/476GMfQmthLlHu52bAig/y37B2wpAjTiqcGalVVe4EafQsk5A:KA/47iLl9Uici7GLNalTe4lk5A
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4220	3368	rundll32.exe	84
PID 3368 wrote to memory of 4220	3368	rundll32.exe	84
PID 3368 wrote to memory of 4220	3368	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\russian.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\russian.dll,#1
  2⤵
  PID:4220

memory/4220-0-0x00000000754F0000-0x000000007555D000-memory.dmp

Download