0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783

Analysis

max time kernel
137s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 05:11

Target

SDL_image.dll
Size

36KB
MD5

0806f5a57426aa9efa8e83bf8abf28e4
SHA1

4e8034db61a14c666b2b6bd06bca297e6d69d645
SHA256

b8ded3363231095ffa16fb3db46568d8459269023f0c1846beaa0000bf4ba790
SHA512

b9741aa16b9f45acd2d3262d06f1c7c275ca1d47466c8b5dd4cac8db6afd87bb6001936e9ff1834ecd0f87550a9300d372381289005f14ba164edb07ff80e6d1
SSDEEP

384:I2MwCZn1bbnllVagYWECdiPxmYUwQgbiTQl/miu28SC8DcU+MtYvB9oc:I2Mw01bbnDVfYWECdgx5besFu1S9teZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5108 wrote to memory of 2520	5108	rundll32.exe	rundll32.exe
PID 5108 wrote to memory of 2520	5108	rundll32.exe	rundll32.exe
PID 5108 wrote to memory of 2520	5108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL_image.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL_image.dll,#1
2⤵
PID:2520

memory/2520-0-0x0000000002AF0000-0x0000000002B2F000-memory.dmp

Filesize
252KB

Download
memory/2520-1-0x0000000001140000-0x000000000115B000-memory.dmp

Filesize
108KB

Download
memory/2520-2-0x0000000001230000-0x0000000001241000-memory.dmp

Filesize
68KB

Download
memory/2520-3-0x0000000002B30000-0x0000000002B57000-memory.dmp

Filesize
156KB

Download