e560ea106fd305a159dded28fbdabd97013fb1f7f050c7bea200c90618a07f96

Analysis

max time kernel
42s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 14:01

Target

DangerS-Hack-HNS/Dangers-Hack-HNS/Interlagos.dll
Size

532KB
MD5

ff4a26e0676b56e28cdf3143918e64e6
SHA1

08d78e284b6161c4b73454b032c6c46e017a8856
SHA256

73813d2fd905e5a78109e309a040e8670afc8c184b05fc36b8869255ae75b400
SHA512

4ff5b458369ba8f7d8ce146211b18c099e0160000f6c59869b895edcc134d38f5de4f7dc83c6fbca1d3a468de6df2be2ab7ee13524ad7deebea74b85d4c21f6b
SSDEEP

6144:l1UOM9n8kof8y3m5ocKMHVZc/JnfUe9lTei089p1fDB2G26aNbpQxb3YZrQ:wROkQj25o5MHVW/p085fZ26M9nQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 436	1196	rundll32.exe	82
PID 1196 wrote to memory of 436	1196	rundll32.exe	82
PID 1196 wrote to memory of 436	1196	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DangerS-Hack-HNS\Dangers-Hack-HNS\Interlagos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DangerS-Hack-HNS\Dangers-Hack-HNS\Interlagos.dll,#1
  2⤵
  PID:436

memory/436-18-0x0000000075510000-0x00000000755CE000-memory.dmp

Filesize
760KB

Download