6941f4998c8d31028e70cf62c5052999b1a15ee2d615f4eee31173d68cfa60b3

Analysis

max time kernel
132s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 14:47

Target

Squid.dll
Size

101KB
MD5

498720e9b4e27dc1098e47513e4c0776
SHA1

11ee6e84bc167cfcd2095a114ad0a233276ad7c9
SHA256

7a5002c46de6c3b54ac8c6c63ae6a20c6f4301c85c9391ba8b09510012225d54
SHA512

8bac5db90afd93630da9a5120165cbb38fdc16d68f3da933f27cb795adbc1a55131e2794fd74f4506b5188696cd264db5b24ea2071cdded08351490144a04442
SSDEEP

3072:WYePe172ZVKRzzhRcm0elX49uieYZVssne8dAxPFeCf7hwpNq+vKWoIuf2IqDkIU:WYePeN2XazzhRcjelX49ui/ZVssne8dm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4236 wrote to memory of 4688	4236	rundll32.exe	rundll32.exe
PID 4236 wrote to memory of 4688	4236	rundll32.exe	rundll32.exe
PID 4236 wrote to memory of 4688	4236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Squid.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Squid.dll,#1
2⤵
PID:4688