4c51547745fd5b7c107e5b89cbd6be9ea4d43195fb4a1011987c8a33b7158251

Analysis

max time kernel
137s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 02:50

Target
Main/Converter/V0/Interop.ShockwaveFlashObjects.dll
Size 32KB
Sample240302-db1qeahe48
SHA256 d77e1ef64e95051f8277a7f592dd4f3392f536233b140b42998d1ee33b358c61
MD5 01baf04ab956cbd8a5cf37c5b0200841
SHA1 8bd6b5e6855844fda481256d52092a56e555d746
SHA512 4a3a82cec74fb45654889b486ec171c5e90091e280987191916bcab84223567a46038f5bbc39428ed3b5be220dd35bad06e766ef1282f0e519cff02d1de8721e
SSDEEP 384:rwXxCB5Qr+uyIY7ut2i5nKoR9ouIfcvdDW/Ie7xI5k/5kgVq/Lq+1f9:pBCr9Y7ut2i5nKgfvM/Ie1ik89
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3588	1596	rundll32.exe	88
PID 1596 wrote to memory of 3588	1596	rundll32.exe	88
PID 1596 wrote to memory of 3588	1596	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Main\Converter\V0\Interop.ShockwaveFlashObjects.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Main\Converter\V0\Interop.ShockwaveFlashObjects.dll,#1
  2⤵
  PID:3588