a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/DirectMediaXtrasset/DirectMediaXtra.dll
Size

328KB
MD5

7732407801a0d3b29183f7fd12de661f
SHA1

18765c9c24783b93d8c0902c671d4527a7ca461d
SHA256

188725405c83941821c115c59bf3dc8320e4b989a94cc0130c7486f706f8278c
SHA512

a72f9d98322e2ccbae3cf4e4a287c6ebb82c9944ee2d0b742e8eecc70cc891659a2aae2fae3e322f71676e1e8afc1551f09db5f7246b67e32781fddbd2a3da8e
SSDEEP

6144:6u3Rvli/QTz0cBLT/lwgIYFi9PNyLZEk/U:6u3Rdi/QP0cBLTSgIYFi9PNyK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3540 wrote to memory of 2468	3540	rundll32.exe	rundll32.exe
PID 3540 wrote to memory of 2468	3540	rundll32.exe	rundll32.exe
PID 3540 wrote to memory of 2468	3540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\DirectMediaXtrasset\DirectMediaXtra.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\DirectMediaXtrasset\DirectMediaXtra.dll,#1
2⤵
PID:2468