64690e666518ea5fa250cb3f58b626537af21b4ccc4d58a1eebdf0bf11f10077

Analysis

max time kernel
125s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 13:43

Target

resources/app/PKVSKeyChecker_protected.dll
Size

1.4MB
MD5

074a37cba804848e3414f47b4114ddbd
SHA1

045881e97692066350f355178662eab6d7b28ca8
SHA256

38653c0bee1ece5f849d8c9c0163861f02adfdf5c4684e1157a30d21405b9fbd
SHA512

076d7b0946d6936d1d4d860f519680784361242c0ac87de08e91e5c9e3af47acf6c9ddf5266017b35ebf2ad859988d2b834f433732d28ab85ed431640eabf83e
SSDEEP

24576:avN0vMvEQAqpB5c3eF0XFbATsbDNJ3TwzSWX6w9kYm4CyRsOe6CAOJaaV:i0vMvYN3edYrDwNAb6CJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 900 wrote to memory of 1884	900	rundll32.exe	83
PID 900 wrote to memory of 1884	900	rundll32.exe	83
PID 900 wrote to memory of 1884	900	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app\PKVSKeyChecker_protected.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app\PKVSKeyChecker_protected.dll,#1
  2⤵
  PID:1884

memory/1884-0-0x0000000074ED0000-0x000000007502F000-memory.dmp

Filesize
1.4MB

Download