92398041f3a13983de9f48a87e70087a8b44c4b34b79a4d8950f1a36d8226ff7

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2024, 18:26

Target

Nova pasta/BitSys.dll
Size

64KB
MD5

f6cea89f337e77f662782f4331794678
SHA1

03b7738fe3551353056db9f253b99530073da9f2
SHA256

7732c7b5dbd448c2c535f13ab95239e25242f53f0339bf866179b9b488ed8e0b
SHA512

699a4b48784c44ba950056db4f0879861169deaf21a493d965a3f6b22967e53b739bae63b05b5fd005f7d04806314b532b6971e70e7c9fbf4d14c79a64a95e15
SSDEEP

768:/2mzZ9j8KnZ9GVtuRUhGVNq+iCqePGyISGy/FpnUq+iC/yqEpr7yZ7DvOHD0aSC/:v9jRZ59wSGIriDmOy/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1112	640	rundll32.exe	84
PID 640 wrote to memory of 1112	640	rundll32.exe	84
PID 640 wrote to memory of 1112	640	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Nova pasta\BitSys.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Nova pasta\BitSys.dll",#1
  2⤵
  PID:1112