4c51547745fd5b7c107e5b89cbd6be9ea4d43195fb4a1011987c8a33b7158251

Analysis

max time kernel
130s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 02:50

Target
Main/Converter/V0/Interop.DSOFramer.dll
Size 22KB
Sample240302-db1qeahe48
SHA256 7503588072587fe1346fb40026124e230b122ddf2666e4046815fee37010b0d1
MD5 34ba3325cebfb8a49fcbe3ca36435133
SHA1 98fa9dca395bba129f9774c82a7a2e5154841a8d
SHA512 50b8b585d59725fd579e34c24c90354e7a2e0bb4d565d2d7f6f614279f9746514baff6435b3299b0e36c7ffbbc41508f26d68396a1d918eb23086644464a46af
SSDEEP 384:+KZKzkteHYgcfvlBKlP79le5cXkYngHKeUZw1hjCO/Jns8:9KzkteHYgcfN479lh0Yng1MXO/T
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2072	2076	rundll32.exe	89
PID 2076 wrote to memory of 2072	2076	rundll32.exe	89
PID 2076 wrote to memory of 2072	2076	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Main\Converter\V0\Interop.DSOFramer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Main\Converter\V0\Interop.DSOFramer.dll,#1
  2⤵
  PID:2072