e49e2826c4d9fae960ca6baecd6754400e5da74446c5b511beb15831b42f2b1d

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2024, 03:54

Target
NvSmartMax.dll
Size 20KB
Sample240209-egbtxafe51
SHA256 eaaa7899b37a3b04dcd02ad6d51e83e035be535f129773621ef0f399a2a98ee3
MD5 0b21678ed8e2b117344cfceba8f097dd
SHA1 db53bb022cb6de016713f1570f2ae501f20f9c76
SHA512 182268649b360f44f021570ddc9290f5051a8be556ffd66355bc325027ba48c5fe824e1bea925411bdaef4c17e0f3d81a1d3c710b59c4462540d567da625a41a
SSDEEP 24:eFGSE+O1B+ibXvS1vFNFPitSa25Jyj3xrqhx4/:ief+BFCtSa25JySx4/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1808	3156	rundll32.exe	84
PID 3156 wrote to memory of 1808	3156	rundll32.exe	84
PID 3156 wrote to memory of 1808	3156	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NvSmartMax.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NvSmartMax.dll,#1
  2⤵
  PID:1808