eb25a842053c71527656aaf759dd64d333ea0e66f0e237d716340ec5bdb073ab

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:18

Target
$_43_/Modules/ManXec.dll
Size 97KB
Sample240613-bpec8aselr
SHA256 3a6886badafbf4dad3da593097117e252475f3296c85071c53da51ccb7009a38
MD5 95cf944c390c06a45b7a455ebf340173
SHA1 ad2c1b92932a52c04ace29cb921bd06d1ca56e53
SHA512 9bc85c527741a90f554fe82d4735fdf003e1b0a7ca40404b763627ed1fe0fe489b2c0e603c3cd90a96120ebb242d718835733f1f3988629be4b0c516ac3229d6
SSDEEP 3072:XLMhjuktfSPQhoSvwQsVQFMSkx9D4bZ9KIJylsrC6otcTdx1PXQK6aJGTfP9O3ys:7MhjVtq4hoSvwQsVQFMSkx9D4bZ9KIJJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 648	2368	rundll32.exe	82
PID 2368 wrote to memory of 648	2368	rundll32.exe	82
PID 2368 wrote to memory of 648	2368	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_43_\Modules\ManXec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_43_\Modules\ManXec.dll,#1
  2⤵
  PID:648