1743c09774c8aa85ea6463bf48def681e4ccf13660620e7378ecd9df6c33169b

Analysis

max time kernel
51s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 16:37

Target

Fish-v327-0221/msvcr90.dll
Size

640KB
MD5

e7d91d008fe76423962b91c43c88e4eb
SHA1

29268ef0cd220ad3c5e9812befd3f5759b27a266
SHA256

ed0170d3de86da33e02bfa1605eec8ff6010583481b1c530843867c1939d2185
SHA512

c3d5da1631860c92decf4393d57d8bff0c7a80758c9b9678d291b449be536465bda7a4c917e77b58a82d1d7bfc1f4b3bee9216d531086659c40c41febcdcae92
SSDEEP

12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4352	4792	rundll32.exe	83
PID 4792 wrote to memory of 4352	4792	rundll32.exe	83
PID 4792 wrote to memory of 4352	4792	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\msvcr90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\msvcr90.dll,#1
  2⤵
  PID:4352