a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/AWMP3.dll
Size

68KB
MD5

ce942afc3415b1d6f588c64371795721
SHA1

258129fab7dd76c5f5f41f8b1b7702e0c2e63781
SHA256

092af393a8e01e8588cc0f427fff080126d0081fc923e4e2bfe3ea714cc43b6f
SHA512

11e148b03b1dd9db9eab941b14f3d055754d01a3607be64f7af840b4da5200435ad4bfe44b42576e758d5111cd0fad3cf2a9f9654b997985a4d634be03325c26
SSDEEP

768:Lad+/gC4fNzn6FWCld/qQTSAbsJf6ZiCZl6ViB9Su58lL6M65Dg2LokM1B:LfICkNKTSQTSgL43qScMQjo1B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3656 wrote to memory of 5092	3656	rundll32.exe	rundll32.exe
PID 3656 wrote to memory of 5092	3656	rundll32.exe	rundll32.exe
PID 3656 wrote to memory of 5092	3656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\AWMP3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\AWMP3.dll,#1
2⤵
PID:5092