595f4fc0f66cfba69430aad00411be104f37958edbbbb773a105b2b9f06f6fa8

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 05:27

Target

$LOCALAPPDATA/Salad/workloads/gpuz/coreclr.dll
Size

4.1MB
MD5

67035314cca8853cd098d82b9d2c403b
SHA1

2d6d27c2d6d2d2c41fb97459011bf2a6c739a047
SHA256

7ee447ef0a3125c1f41162e6f8db6575dffff574e91aa1df356bcc85b21d0ec2
SHA512

b0298790ba67409d441ceb0f70acad6c242e85e169864c31462613d4ebdc10a14e4d64cde1f5f86c332ecea34f6e880fc5355ae2daf9a88b96875babcc6fd649
SSDEEP

98304:erDpJIc5x5rH/rhf9kSO6FdEFsecv054MzwlXaXQxoyRaf:oDpJLBrfrhBO6FdE+e/53klGILAf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1300	4652	rundll32.exe	12
PID 4652 wrote to memory of 1300	4652	rundll32.exe	12
PID 4652 wrote to memory of 1300	4652	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\coreclr.dll,#1
1⤵
PID:1300

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\coreclr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652