25b48c2f91a8ad55b946a746fd5d99d231fc684e25674908bfd7d11cd77d00d7

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 00:28

Target

SniffX/packet.dll
Size

80KB
MD5

28f57308b067836d715aa070d29c3232
SHA1

6d1642be7427e692777f8fd806e96d5266bea220
SHA256

620ad70506f21c2806396a34025471245ebc2f3786068d9c74c49973e754ffc0
SHA512

3475db4a2838a22ef803a94ab2d386f965efedbdb291f7bd1ed9549eee9330540795b691cb4cbd2442a79280a953632087be00f6ce3d1a816c7fd4a359fefb7a
SSDEEP

768:FnQWfHyWMJhLtHEVjICC+dgQbIbo2T0eG/TbTpW3ocmXeyimCIu9y1l4VK/gw:F69EW02T0eG/TY3ollCI62loH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1416	1688	rundll32.exe	82
PID 1688 wrote to memory of 1416	1688	rundll32.exe	82
PID 1688 wrote to memory of 1416	1688	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SniffX\packet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SniffX\packet.dll,#1
  2⤵
  PID:1416

memory/1416-0-0x0000000000A60000-0x0000000000A70000-memory.dmp

Filesize
64KB

Download