595f4fc0f66cfba69430aad00411be104f37958edbbbb773a105b2b9f06f6fa8

Analysis

max time kernel
132s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 05:27

Target

$LOCALAPPDATA/Salad/workloads/gpuz/mscordbi.dll
Size

1.1MB
MD5

2633a5a90e4508e91879fb0ad8f55f73
SHA1

981ab04c19009df817ec9e857c0a3e0b2f869ace
SHA256

092d9c52bf705abd2832bd6f4b97f75075e77a0a928794194017d5a159c3240b
SHA512

858c921369f76af6aa8404942a842aad2be7975769ec5d753ba8dd19f1c0535038105ff1f8d8313e130069e35e2ddfb6a6c8c8872f5882e0d3217dc9a5938786
SSDEEP

24576:dbd3w1Y7GDSztheMdOcOVpVqsnvyxhQo5vzMIegCbGpb:YKkSbeMSsCyxWoZzMIebbG5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 3440	756	rundll32.exe	94
PID 756 wrote to memory of 3440	756	rundll32.exe	94
PID 756 wrote to memory of 3440	756	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\mscordbi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\mscordbi.dll,#1
  2⤵
  PID:3440