0a88f72346f89c165a3e3b56b36dcc67ed79484cc82858c31346d2f4d6b29ba0

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 01:51

Target

SomeRandomInjectorTest/src/injector/injector.dll
Size

30KB
MD5

5867572b900cc55a381c1dff4ba2a579
SHA1

24b29b527b70b2f2da84cb11af62b9d9c6f6af1b
SHA256

eac8342bf324ca6490bc07594b3fda148e5fc9581cf5546af60a8c726e2e28de
SHA512

e1b6f36b6edc985336cc0132c21af339aca696876ee3b642a309e6f59c7d0e6cdae793efcaacf54ef5e61478c5717c3e0874f3cd9c5188b4b000c7e318d060f7
SSDEEP

384:xP7oDk7Lkp/Wiv4Js6mPeuaBU3losjuzZ6UwYRGZqI7PDjS7+:9ZLkrpPP3lLuzZPKqAz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3592 wrote to memory of 1244	3592	rundll32.exe	rundll32.exe
PID 3592 wrote to memory of 1244	3592	rundll32.exe	rundll32.exe
PID 3592 wrote to memory of 1244	3592	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SomeRandomInjectorTest\src\injector\injector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SomeRandomInjectorTest\src\injector\injector.dll,#1
2⤵
PID:1244