a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/FLASHASSET/FLASHAST.dll
Size

1.2MB
MD5

bd3edb1059c5cbaf14d23b554b54b1cb
SHA1

81c0c2a41e79e77ef4fd302a6abf4804d641623a
SHA256

6a80690b12522d5c359801801e10a0789b066a99b46e5ae0801d761e5c15fcec
SHA512

fbdb9a0844b934153207d7c20fb7e94e0fde97785b33d8a39db74f3058b71b473baca53b681802ff88e07c5ba4399ee30e522e0aa26c9c50f2e1ed5886034578
SSDEEP

24576:+lH0LemqP4dUFt93h857xY0lXEj/oJmrMmOR3EF5v2dX5Tcr+nd/lvzRVT+0RWzy:rLno4L3EYT1hzqVLJq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 316 wrote to memory of 3640	316	rundll32.exe	rundll32.exe
PID 316 wrote to memory of 3640	316	rundll32.exe	rundll32.exe
PID 316 wrote to memory of 3640	316	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\FLASHASSET\FLASHAST.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\FLASHASSET\FLASHAST.dll,#1
2⤵
PID:3640