a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/GIFIMP.dll
Size

52KB
MD5

a308e530533be834313fdc0901636025
SHA1

f49fcb5318193e18a5e8ba35411ce2d4d8e1bfe2
SHA256

722d02354da072a96f42914288d2a52b2e633971b19d0dc54d8de989d0b31e31
SHA512

6a22a1f64bae586bcae4fd5cb48326fa718ccdd643a22859fe5c3cb5f0b36f2bbf05e74c8de89a6af5ad1f49e7ae4defa55e9adc748505fa1b5b6a11b61521fd
SSDEEP

768:TEFV6eIA7VYuSj4hKekvbknw64jKezVeyDzi+vXMoO+fjevrdhak:TESBWVYPjIKee6w6ZqVDzBPMoO+Mdhz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 412 wrote to memory of 4348	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 4348	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 4348	412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\GIFIMP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\GIFIMP.dll,#1
2⤵
PID:4348