f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:56

Target

nEO iMAGING/atl71.dll
Size

87KB
MD5

15489dd9c7159aa1bd38e72a6bc76f94
SHA1

874f5c554c392619223a49ec6d0d76dcd59739b7
SHA256

889e19a93bf3e0e11c1cdca9c90b79516a592510970ffb431dd3b30400b37f54
SHA512

2eff43bad9efbc5996e080218d5b55c79d43c276b1cef2148cbbbed87093bf7253ed0ea5006a962b8b3da99cfdf0c6e2f6607cbebd44a25e99c80787e7005206
SSDEEP

1536:RAHeH3G9BP9qwJgxeI+wuC80H+QfIUTMtqnZ6sP+/J51yc7g4Zwmebv/4:zG9xfJDI+wR+QfIstW/Ryc71Zwms/4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2868	2872	rundll32.exe	86
PID 2872 wrote to memory of 2868	2872	rundll32.exe	86
PID 2872 wrote to memory of 2868	2872	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\atl71.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\atl71.dll",#1
  2⤵
  PID:2868