595f4fc0f66cfba69430aad00411be104f37958edbbbb773a105b2b9f06f6fa8

Analysis

max time kernel
128s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 05:27

Target

$LOCALAPPDATA/Salad/workloads/gpuz/clrjit.dll
Size

1.3MB
MD5

cb493e870594b61b604fabff76c1ea5c
SHA1

3ac8a5ffec57e9fbf075ed553c9ed0e39b437160
SHA256

e16ba65f1abdc427a6b25a07ac4e0d7f5dc678c4b16c1b80c84649cfc732e476
SHA512

e94ef95ab671f451be242be0dff9ed0e366f68fe470da85e402643aff2c893a51c2c95a72d48bcf9938057a5115bd64b944d4f4d1363d85a76f483895e1c5f35
SSDEEP

24576:exxCOcH8i/i4mEpPlwaicSii4Dh9rCkGPsQTTJz5+I8vOWN63dolpKQL1SHet:UxaH9EKPlwai94DrrCkGdJt+dvx6toBH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1608	4472	rundll32.exe	90
PID 4472 wrote to memory of 1608	4472	rundll32.exe	90
PID 4472 wrote to memory of 1608	4472	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\clrjit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\clrjit.dll,#1
  2⤵
  PID:1608