9ff40de5a55aa6b5cf34c61acd52a26f77c6eb5cf1d464e0e651a046227a7b78

Analysis

max time kernel
146s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
18/02/2024, 16:09

Target
expatai.dll
Size 400KB
Sample240218-tmaw5ace25
SHA256 ed10a005bbab4385775e5964586bad0c1d267edbf87ce98feb3cc7135877cca1
MD5 dd55071ced298687339566cbe9b23c40
SHA1 1b5f760daab97658f7c0f7c28db35f10bde761bb
SHA512 ae9753860775be0039463c408e080a2541465562702c2407b46d3ab15dacdae6721325eb60ae72e0b389da2524e6122593a6f9bf42f1c2df5c2cb8463c4026c8
SSDEEP 6144:0iKR+8NAOuiLSswqA5YcgU8IoIkfvvIsAOIjAOktasHaF:U+8TSpqA5Yo1kfvvIsqjM6F
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2612	1924	rundll32.exe	77
PID 1924 wrote to memory of 2612	1924	rundll32.exe	77
PID 1924 wrote to memory of 2612	1924	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\expatai.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\expatai.dll,#1
  2⤵
  PID:2612