1741be55d741c6d4cba3d685241aa1f10c05517bc6dab5392ce4b4f945ff184e

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 22:26

Target
WebEx/Ateditor.dll
Size 316KB
Sample240527-2cre5add32
SHA256 9940de24584d7c63d811e9b2acc58d3fce078f28937adeeeb8cbc6e2844f8bad
MD5 78c21544a2fbb660f002089d17f6ebb0
SHA1 2e0f0fa6a6ad18b953037d31a04ff22f5fbaef52
SHA512 107998debb73c2847dab75f6ed11a0bb94c1d218f617fa51eaebfb8742433610a0e35cabee66d514b65b2ec6e05518752a730d50369f60012dd791b4f9995a92
SSDEEP 6144:NlFVRntXFdhWTKSwRrfTgv5r/mHzXOgcog+BfumP:NlTXFdhOrwRDTgl/mTVjn8m
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2384	1656	rundll32.exe	83
PID 1656 wrote to memory of 2384	1656	rundll32.exe	83
PID 1656 wrote to memory of 2384	1656	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebEx\Ateditor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebEx\Ateditor.dll,#1
  2⤵
  PID:2384