6bd6cd1c6bcfe0790fc8f5d50afa96c0b0d300c823952d98c68154e178bc5083

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 18:44

Target
ASUS_WMI.dll
Size 224KB
Sample240122-xdf9bschc2
SHA256 6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5
MD5 3f109a02c8d642e8003a1188df40d861
SHA1 f723f38471b8872443aa9177eef12a96c02cc84a
SHA512 023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da
SSDEEP 3072:Y4WuqFgPmBNRP8hXzGXPkW6ZZW8egH1/jQoAg0FubAxZ+051gh9b6q4TQWdO8g:Y9t2nhQ2ZW8ecAOAZCqQWY8g
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 348	4816	rundll32.exe	87
PID 4816 wrote to memory of 348	4816	rundll32.exe	87
PID 4816 wrote to memory of 348	4816	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ASUS_WMI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ASUS_WMI.dll,#1
  2⤵
  PID:348