081b2455cbf464eee43082d023137137eaf43b7a6e1f475feeb75b7cdaaa4cac

Analysis

max time kernel
92s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 01:02

Target

Sora - OpenAi v1.1/__MACOSX/ext/php_ioncube.dll
Size

779KB
MD5

c57d5f4ec2992e6b06e891d09dcc3e32
SHA1

f1627024fe4a922a43e2163d77da987918635ca7
SHA256

4b6f679ab3da317ee310d5bd482b41a77f5ebf1fc0d514d3595c3d16db6e7327
SHA512

ed30da1c8950865c380b6d13468af1075e4161a052199ea77d071851d297c14c041e082377935d5a8deb3807df6a6bb375c63d3f017c91b425b63a22c82f6151
SSDEEP

12288:8g63h4h0gJBCq4l8D2HVoiFMAIW08gsMJJiJKoRMYBmXml:8g6R40wI8D21onA8DJioXXml

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3000	4372	rundll32.exe	85
PID 4372 wrote to memory of 3000	4372	rundll32.exe	85
PID 4372 wrote to memory of 3000	4372	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\ext\php_ioncube.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\ext\php_ioncube.dll",#1
  2⤵
  PID:3000