dda8dbb86425ea73b9ff11c109ea0e207b2c40745c5c20e9dad86230828c5ddd

Analysis

max time kernel
139s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 21:47

Target
FSMaxView/FSMVIcons.dll
Size 152KB
Sample240304-1nnmyaee2v
SHA256 4c0ffaa3020bfeabb1632ff3543bf4ed0f63211ed184bbe2d83549fa8bf350ac
MD5 ea0a360f315484ba34aba0024c525f10
SHA1 0661009e526b3014723a8cf74862d0e757e908da
SHA512 e16e46b85eeb49e0f2aa3aac04b758428b0a716bb19989185f6aa38791bbfb52d02e80ddae22dc59bb700698b05cce78fcdba7cf6cc0c7f98a3ed10df418ea1b
SSDEEP 768:LyTT3ySfecwZ3U3SMC311SX83fO3U+Yv3W353y7m3z6IdDLb3C8iXC3Ap3RXiaIJ:CjwPPgXWlvJINL+hXH7yaBhWlmpdtg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4876	4788	rundll32.exe	87
PID 4788 wrote to memory of 4876	4788	rundll32.exe	87
PID 4788 wrote to memory of 4876	4788	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FSMaxView\FSMVIcons.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FSMaxView\FSMVIcons.dll,#1
  2⤵
  PID:4876