bd7623e8f6571ae78d1495de53755f1f4a5ce1370a5296f6eba629d893740214

Analysis

max time kernel
138s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2023, 07:03

Target

Device/HarddiskVolume1/OldUserProfile Alessa Domain/salu/AppData/LocalLow/BrotherSoft_Extreme2_B1/hktbBrot.dll
Size

1.0MB
MD5

44b16fb2d8a860fdea6f4e5eeb7d59e1
SHA1

a473f1057d0844c61ed68047f97c6cd8b3f79f51
SHA256

92cdfd800e4f70b5d1c2c722670f22ee86d634047c4dcf5e3c9294155f8e0fb4
SHA512

d9da9e6f63f03cadaab606b6fffcd0197053ff2e38b66929fa258c75ec803c7a0c6de108baa5165cff6c542d623b513563a6dca64bd4bf23b49ec676949fcf3a
SSDEEP

12288:B4MoW5hyJ0Gs2flY4HEx6YU9SP9qGqFb3d1bM/aWYUOGvWSfqg:4WHyJJfYU9SP9obN1gyWLOpSyg

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2316	rundll32.exe
2316	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2316	4020	rundll32.exe	83
PID 4020 wrote to memory of 2316	4020	rundll32.exe	83
PID 4020 wrote to memory of 2316	4020	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume1\OldUserProfile Alessa Domain\salu\AppData\LocalLow\BrotherSoft_Extreme2_B1\hktbBrot.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume1\OldUserProfile Alessa Domain\salu\AppData\LocalLow\BrotherSoft_Extreme2_B1\hktbBrot.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316