fcfcea85a15e4cfeb120fb025974a9c3c115bba77f1ed860782861bec4e0b926

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 19:38

Target

DMStartupWizard.dll
Size

361KB
MD5

7f9a4020950160f29fbc6d47f4602721
SHA1

adb774fcacc4c4fc681497bfe44007b73f0da625
SHA256

bec638df0f512b5df4d7f76783df149350a7f4bba846bc598b6747b4d9d29ce3
SHA512

13d833d251d2169bc173b322e14e6622678276582864046a47d1450972a018b46a177191832ae0cd36eccb291ed6b09ad6ed992b809a7cd1b0852f170d46f2af
SSDEEP

3072:OvBhvBjvBzbDynVr0820q+8G9US77nL7H7V0/LekGpwF92vBwZX6JPD+PjVM5KQ0:wPtzb2RrDjUwjnZie5GswZq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1348 wrote to memory of 1148	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 1148	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 1148	1348	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMStartupWizard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMStartupWizard.dll,#1
2⤵
PID:1148