0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c

Analysis

max time kernel
124s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 00:13

Target

components/foo_albumlist.dll
Size

268KB
MD5

bb8af7ed564933ef446968a0cc863666
SHA1

bb51f36259a182014229213906e4ce4ebbce90f4
SHA256

2533ff54d0c4119b54cd769788ce1d656963e5c322c987cb1409b6ba4414ca33
SHA512

5d6c5714de3f123028d8c12a2cbf0fd149bf9273200a146a39fe7665586104f248d25c664eb480837527f6831f521f10c8cd87be342a5ecc58578c53c164c918
SSDEEP

3072:69xZV7nP6XdvJJoHYt3vIIlrMq6BFb6N35+aqZxVyxAL02Ag0FuHQBCutSbR3nmv:C7u3PQaBxg3AOwEdVX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2508	1728	rundll32.exe	85
PID 1728 wrote to memory of 2508	1728	rundll32.exe	85
PID 1728 wrote to memory of 2508	1728	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_albumlist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_albumlist.dll,#1
  2⤵
  PID:2508

memory/2508-0-0x0000000010000000-0x0000000010049000-memory.dmp

Filesize
292KB

Download