0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c

Analysis

max time kernel
92s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 00:13

Target

components/foo_ac3.dll
Size

158KB
MD5

86c0604ea6de31ff978dea7eeb235d9e
SHA1

1feeae651de1312880296c35c3e4273bb62b4a78
SHA256

7d60462a9f442c6433b0bdcbc6349ce4962fe0828f6c64101b107e9cf907900b
SHA512

9f6f70b6cc387e096aabf3b618f614152917fcca4763c7ff77ce3dbc1595e2192df40eacc4d54b2bab89124b34cb9351490ec0e428e5c8dda40d5b9fad0d1353
SSDEEP

1536:pRH33UTpGsix0FxMgh3f58tkAGwoZ+3djmfGSY1dFo0H83lFoxG1xNkgXc1ZAmtR:nH33UQVH1djjdSL3lFp1JH+qdtEMv+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2308	4076	rundll32.exe	83
PID 4076 wrote to memory of 2308	4076	rundll32.exe	83
PID 4076 wrote to memory of 2308	4076	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_ac3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_ac3.dll,#1
  2⤵
  PID:2308

memory/2308-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download