6cb97fec0ab2adc6168a3a7fdce68db81c3c04999fb38e076e270789516a350a

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 11:56

Target

API_COM.dll
Size

295KB
MD5

2ec27c0604e85cb480f9c751bfdd210b
SHA1

f9f6992210d14456d3230795adac0b3f16b136c4
SHA256

5005f3082768b142e1f96af7139d57c59de21a04bc04c8956ec3a29ea728861b
SHA512

d5956ca874b1e468f361ddadf9fbe8d2d7fd53fc60a201d6e0fa20092e54785f4a1fd24133251f688ff62a06ede79bdf0b8393bdc3d96a279d07c75bbb3039d1
SSDEEP

6144:UwbZgYtmXMsoAdkM40g8okAbstl2FSLgP0te/mDNjPqAlzfNUWTGjGyvKOXHyVyi:UKgYDsotM40g8okAbs72FSLQ0te/mDNJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1792	1140	rundll32.exe	83
PID 1140 wrote to memory of 1792	1140	rundll32.exe	83
PID 1140 wrote to memory of 1792	1140	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\API_COM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\API_COM.dll,#1
  2⤵
  PID:1792

memory/1792-0-0x0000000001F20000-0x0000000001F6E000-memory.dmp

Filesize
312KB

Download
memory/1792-1-0x00007FFC9C0B0000-0x00007FFC9C2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-2-0x00007FFC9C0B0000-0x00007FFC9C2A5000-memory.dmp

Filesize
2.0MB

Download