c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2

Resubmissions

19-07-2024 19:18

max time kernel
133s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
19-07-2024 19:18

Target

maddisAsm_.dll
Size

61KB
MD5

84bc072f8ea30746f0982afbda3c638f
SHA1

f39343933ff3fc7934814d6d3b7b098bc92540a0
SHA256

52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006
SHA512

6e7648194738e8e49e48c2450eef1d482473cd4e5c0e83f292ac9174488f3f22a3b6ba96f07e024c2ab96613d9db1a97084ca0b3973ed5d88502e0d28e120ef5
SSDEEP

768:RhaUyLDjc8SqMhnJ/zq0siFsjB5mYdWtC16+C+024bQJu0D3BIBo1w4Kv57dbhrC:RNy3eqMne0sXB0IWtCLwEJhY0w1SD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 2580	4236	rundll32.exe	72
PID 4236 wrote to memory of 2580	4236	rundll32.exe	72
PID 4236 wrote to memory of 2580	4236	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\maddisAsm_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\maddisAsm_.dll,#1
  2⤵
  PID:2580

memory/2580-3-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/2580-1-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/2580-0-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/2580-2-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download