d16dddc1e9ad69c5ef67afd93eb801c74ca5b95ec8b46741786c8c8ec47b1b1d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 20:23

Target

heur001.dll
Size

124KB
MD5

840c8e9d2aaccc87d6dad1d409e45a10
SHA1

41be046bf69a7a5bbf27b224554f42d81f5c9c47
SHA256

68fe6616070f5d5d20b12ff020a6197ae93a93ae06d24bf6e872cc35862f758f
SHA512

ed9bf5b7252e26035e1c5779f7f4a065315970e206dc23463cc7dec07a0e890e0757c757a6ff4d910cff639b911b54b20acd488a2190dcc4ee29628b39eb4012
SSDEEP

3072:WPJLnHOfXoAwOSxoPMVsf0nQla8vxgs2N+r3r+f:WPeRgPvSCsDr3r+f

Score

1^/10

Modifies registry class 3 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3196 wrote to memory of 3436	3196	rundll32.exe	rundll32.exe
PID 3196 wrote to memory of 3436	3196	rundll32.exe	rundll32.exe
PID 3196 wrote to memory of 3436	3196	rundll32.exe	rundll32.exe
PID 3436 wrote to memory of 3924	3436	rundll32.exe	rundll32.exe
PID 3436 wrote to memory of 3924	3436	rundll32.exe	rundll32.exe
PID 3436 wrote to memory of 3924	3436	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\heur001.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3196

memory/3436-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/3436-1-0x0000000000B40000-0x0000000000B6C000-memory.dmp

Filesize
176KB

Download
memory/3436-9-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/3436-10-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/3436-8-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/3436-7-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/3436-6-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/3436-5-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/3436-4-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/3436-3-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/3436-2-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/3436-12-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/3436-11-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download