f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:54

Target

IvsLogic.dll
Size

140KB
MD5

a14c1df2b2e3cb64b6b71cc8cdc7c573
SHA1

7daf0532eeee66ba7f3e27f05b57f557ceae1712
SHA256

f161b838d4439f1a565f49b8f0d7627c33ebea4fbf4466a7dcc51a191d63b847
SHA512

0f9c8f8913f3763dad7ddb26992861bedd31671e6117f92c1917a67c12e310125a08199d42660ea514938f71934c66d4c4b943f6cdd5e5a194a59a05d9aaa986
SSDEEP

1536:5ifKWy92s4V6x3WHrrJXzY8J3DCVsEZuS0qyLd3KHvOqD2NF3gEkDeYMRITTxlcm:oyD0TXzrDSPunqE3KHvcDkD2CD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 4092	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 4092	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 4092	2004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IvsLogic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IvsLogic.dll,#1
2⤵
PID:4092

memory/4092-0-0x0000000002550000-0x00000000025DB000-memory.dmp

Filesize
556KB

Download