b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
86s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 15:27

Target

TwistedBrush/EZTW32.dll
Size

64KB
MD5

a3f0682d40210eeb704a0d5c6878e128
SHA1

aca06cab2e62ab7003809724879e28a882043c80
SHA256

9027feb2b27ab38414b505cce265ff9e839bf4ccb6bc4ad3498a5c3553eb492c
SHA512

7615fe703dac418e3e04f563da90046154a0e19d83c78c6a400ee7c1d2e7adeb41e961ef9db5f657ced0361a289c571e2505baaf07685467bacfd77b14d674ae
SSDEEP

768:j375DeiQq4jBOhZpu8k0La47Tv4CL98mgo3gANwA/vbGP6wqiB9DnJr56okr+o4N:T7oiWjGPPP7TvZ9Golo6wt9YiogPL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3508	3720	rundll32.exe	86
PID 3720 wrote to memory of 3508	3720	rundll32.exe	86
PID 3720 wrote to memory of 3508	3720	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\EZTW32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\EZTW32.dll,#1
  2⤵
  PID:3508