d3e26c7296830666e8d5758afc850c5b596ceb3e2c1ebbb01d5dc22ff58ff5fa

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 18:47

Target
DreamMail4/Sys/DbCreator.dll
Size 264KB
Sample240228-xfbfvsbc98
SHA256 e000acde8e5097bc9d8da88e6ec4a5a673b29b8c36f8a6a093e46f4ed6c06ddb
MD5 0289c236ec4da52cead654b7edf26439
SHA1 c46f16498d3f27d868c9c8aec66688f7ba03ef13
SHA512 14ab2149b05e2b316be58cc0586a814015d6d8baab07ff88d399bfdc7efeaec3a3d3354c3b3b89cf4b2e8b961cb87efc3bc6944c8827e6b840edaa597bb60a18
SSDEEP 6144:2vTXLvoJlAWgxGIyCr67UzHJxvCSbUvG:2vTXaAVXnq7G
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 2268	528	rundll32.exe	89
PID 528 wrote to memory of 2268	528	rundll32.exe	89
PID 528 wrote to memory of 2268	528	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DreamMail4\Sys\DbCreator.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DreamMail4\Sys\DbCreator.dll,#1
  2⤵
  PID:2268