0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 00:13

Target

components/foo_dumb.dll
Size

520KB
MD5

f97dccc1c8e1062cd1746b35ccc5511a
SHA1

93360c193da0d5d4eaa158766eeccf04d00bd50d
SHA256

53a90f4beb5f7b1525bbaf05c81e0af2de1722793ce85539cfdeaec52e7ffea2
SHA512

04bd32f1aa301e0575b73b5eba3c619640ccfc90e154d0121a26d71492992b4446c3512a7ccd682d4807fc32fd5faf3bba39002aa3f9eb1594ab217db15ff09c
SSDEEP

6144:cztiqFf4eoV2YZ0kONQbmnUs/1IjtKoSYBG6IuSgfOEC4uEwrfINTBaFAOWeO4h:PqFToV2YHwrfINTcFN9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4688	2816	rundll32.exe	84
PID 2816 wrote to memory of 4688	2816	rundll32.exe	84
PID 2816 wrote to memory of 4688	2816	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_dumb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_dumb.dll,#1
  2⤵
  PID:4688

memory/4688-0-0x0000000010000000-0x0000000010089000-memory.dmp

Filesize
548KB

Download