9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:43

Target

SaveOperate.dll
Size

89KB
MD5

7f7b0c785097a0587e2986c032148cd7
SHA1

bf5d768072ed0ab5e874e0115b4e1701e5ed9871
SHA256

c14060e1cc122a426007589dd7acb6dd447403132b6995efaa2acb0dba18e5c1
SHA512

e857ba68ae4e6dad1ce1be880ed38de51ed481c0882423a9c6b5c5f00f4ce89a7deb733398b01cc3b22a559e831414baf951f38c3594c7e170b5c8aa2bd01124
SSDEEP

768:kXc8P4o00m+CusjIlenL3iVay4lJLIhTozIo37PNW1zuageMU4p2FIvSR6uE6RMe:Uci4N+COK2Vah+ToqqFL6RWovnFkKBt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5076 wrote to memory of 3248	5076	rundll32.exe	rundll32.exe
PID 5076 wrote to memory of 3248	5076	rundll32.exe	rundll32.exe
PID 5076 wrote to memory of 3248	5076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SaveOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SaveOperate.dll,#1
2⤵
PID:3248