6f8b540361c734dd1b08c829483cc31674ad5dd38909e6e9692bc95f2dfaf24e

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 18:16

Target

KanKan/ImgFmt.dll
Size

520KB
MD5

88860bd93501f6945a2f06e6e2bf4423
SHA1

01998a9ed7a7cfbb814dfc2238c7e9abf9de9d11
SHA256

e8aecf086d734671b79e4aa2f8b7bb468754392c968b4abe27e0b2d2b827f941
SHA512

d78a71c1af629e22f8840c9ccb2717adf4c1b5d6ff2bccd2f2c6f0a1c81c1c88fe570365be642e699b88d4137a00ba04ca75400ad9e58a7bc69a775c4256af26
SSDEEP

3072:FaimVXlXOrQ1Wdadp5ykVSA80rmyusDAkb1MN3Xyk1XHnAi8COO8L6/iKWCp5qea:F6FV1HBKjlNH36JKHqaK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 4300	1364	rundll32.exe	84
PID 1364 wrote to memory of 4300	1364	rundll32.exe	84
PID 1364 wrote to memory of 4300	1364	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KanKan\ImgFmt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KanKan\ImgFmt.dll,#1
  2⤵
  PID:4300