06dbb81cf12b90ce241c2db1eb1413ddc00c36647ee94ee276f926c8fac9c438

Resubmissions

13-05-2024 09:48

13-05-2024 09:47

13-05-2024 09:47

max time kernel
129s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 09:48

Target

konfigurator-1_8_08/inc/M200.dll
Size

527KB
MD5

4e3ca2e6822dce1bd23e300312711d1f
SHA1

2cd199828691832f280bc578c328d48a2a78eafb
SHA256

93b86cb40b5647a4b1e13fd2fc186c658721cc164a3b731ee30dfd8260dd4ece
SHA512

78379c2663029a37f6d58e1aab006dea0c946bbbef1118fa073a99b7931ce11c74cb1df89bedb29fabf952c5c78e4f75e0b1fa3ddca3f123def4bd5a269aad70
SSDEEP

6144:RyZYmiWhDG5YhrURria+hMdjg+IAtvkKnxOgT8im6/Qk:k69Yhw+hOs+IAtDfT9m6/Qk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4072 wrote to memory of 208	4072	rundll32.exe	rundll32.exe
PID 4072 wrote to memory of 208	4072	rundll32.exe	rundll32.exe
PID 4072 wrote to memory of 208	4072	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\konfigurator-1_8_08\inc\M200.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\konfigurator-1_8_08\inc\M200.dll,#1
  2⤵
  PID:208