c89e2b54f3c5d87685524102f4a03430e99d41ff6541c99e97b379ab7f5a413c

Analysis

max time kernel
134s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 10:33

Target
Vulcan1.5 BETA/CED3D11Hook.dll
Size 137KB
Sample240504-mltvaaea64
SHA256 1e30126badfffb231a605c6764dd98895208779ef440ea20015ab560263dd288
MD5 42e2bf4210f8126e3d655218bd2af2e4
SHA1 78efcb9138eb0c800451cf2bcc10e92a3adf5b72
SHA512 c985988d0832ce26337f774b160ac369f2957c306a1d82fbbffe87d9062ae5f3af3c1209768cd574182669cd4495dba26b6f1388814c0724a7812218b0b8dc74
SSDEEP 1536:onOLYqoZQBD3m7bmVLcuVGpGXlWXQznQN8erRxQEmsYOT1GlERbo3iV8n/7DkCWy:o4YqoZNHi7VBAXvXMZ7ll3iyn3WOR3Oc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4256	2276	rundll32.exe	87
PID 2276 wrote to memory of 4256	2276	rundll32.exe	87
PID 2276 wrote to memory of 4256	2276	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Vulcan1.5 BETA\CED3D11Hook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Vulcan1.5 BETA\CED3D11Hook.dll",#1
  2⤵
  PID:4256