7411c9840d6323a40eee89d2b52dedd12b13486b955d6e84d6221ea312b3ae80

Analysis

max time kernel
123s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2023 08:35

Target

download-stbl-win(V(us))/mod/bin/kcms.dll
Size

174KB
MD5

bf299f73480af97a750492e043d1fadd
SHA1

c93c4a2dae812f31603e42d70711d3b6822f9e8e
SHA256

0334e3b7ae677116b92516172d0ca905723daf847d8b3b0dc3fc118edc703d51
SHA512

7265783f0dd653dbc4693d5efeb156281620c5421f29910f14c22b75a936233e9e897087e64b641335795484837f28f113ee9f380027698a898f19115fd0f648
SSDEEP

3072:gWosiKTxga2KtpdhEnGF5PNyR0BxDxxKF5HkEWnuYsauj9Fom1QB:3RRKAtpdhEn/0BzwFpvYm0z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 216	3776	rundll32.exe	80
PID 3776 wrote to memory of 216	3776	rundll32.exe	80
PID 3776 wrote to memory of 216	3776	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\kcms.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\kcms.dll,#1
  2⤵
  PID:216