3da6e78e2de91d5f9ff41af0eb84e6be790438a519d2bd5da50ff7bdcb38d8ca

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 03:52

Target
l3oo/SC 1.4.6/appExtension.dll
Size 130KB
Sample240603-ee8e4abf92
SHA256 4fce9dd494bdb79b28da576fa5aead3e220c8d37a3da1af90386c822d90a1c8f
MD5 4bfd917fb83585a4d9c6494a698e453f
SHA1 07071947075892342ea7259a554bc448cd119a0a
SHA512 941fffc881aad9679421b6a411a33f215de100af6db9431944b5ceb2c667249be371ef30efeade9fcebe2d48585606a117592e882e5caabe83aa91dd202c574e
SSDEEP 1536:yND9LcXkXn/GjLy/f7by9LfvxJOqnQ46+hsWNcdgxeoDh66zs6aJx82XY:29oqfqtXTjVmgxeoDh66zzaJJo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 780	1068	rundll32.exe	82
PID 1068 wrote to memory of 780	1068	rundll32.exe	82
PID 1068 wrote to memory of 780	1068	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\l3oo\SC 1.4.6\appExtension.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\l3oo\SC 1.4.6\appExtension.dll",#1
  2⤵
  PID:780