dc9a325c1cc8008144cc45808a941d50c8b87bc5bceb5c34a26c827404f1a1e3

Analysis

max time kernel
106s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2023 06:45

Target

GS_LOADER/data.dll
Size

2.4MB
MD5

49dec65e16ecf52ba6d65d1359209381
SHA1

237dacbc6570d9c9b4d919dfdbe9901bf515cc63
SHA256

9ac097492073df0282e9161f61f794b1c06688b95be60d96f6233cbf8122e427
SHA512

74e411215a44ba728bdb917501cbd1beb5e3bc2bd673f2a2912bcb6ceca48e41b8eb7ab9ecc11a85cf4f10ddc9605a77612cebf8aa4cd3679ffc7a0e14b100b3
SSDEEP

49152:YCKmqan4No+mhH2ntXGbxbl3Uh/54rXmm3DRYiTKFxU2xsSOxO3RWFQ/4s:NR4cMMxZw54aqDOiesHcRa24s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 2596	4844	rundll32.exe	84
PID 4844 wrote to memory of 2596	4844	rundll32.exe	84
PID 4844 wrote to memory of 2596	4844	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GS_LOADER\data.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GS_LOADER\data.dll,#1
  2⤵
  PID:2596