97cf70062f25b360a517a632165ac3d0f0a28de8cc332438694be046db8d349c

Analysis

max time kernel
135s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 02:29

Target

DuiLib.dll
Size

1.1MB
MD5

072a7dba075bbdf410084209d9cd7be0
SHA1

0841c6e27a923cc3c1b56b93fb58b40697a0caf9
SHA256

75192b27f01751bb998e6fbef58d190ea88aa5d1c4c61b3638501b6fd31eae52
SHA512

5bdcae3a6f448c5b79c976132cae6a8d6a2eda0b8e1db0a87c028ef0570aedaed1f7f15867f68203e4cb2ebbba5ca145cd59cb18f4bef5c79e291d1b106fcb4a
SSDEEP

24576:R/Wxi0+tKI/FlLzvYBjzUeMiof2CgxfTqGuFEEK3h9VsIBTPbs1KK5TXE:9Wxi0+tKI/FlHvKtMiof2CgxfTqGuFEp

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mylkx.dat	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 3304	3596	rundll32.exe	82
PID 3596 wrote to memory of 3304	3596	rundll32.exe	82
PID 3596 wrote to memory of 3304	3596	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:3304

memory/3304-0-0x0000000002970000-0x0000000002986000-memory.dmp

Filesize
88KB

Download
memory/3304-2-0x0000000002990000-0x00000000029C8000-memory.dmp

Filesize
224KB

Download
memory/3304-4-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download