fcadf0a0a2c90421f3b2b67f4649eabec2d0c8d4dda9127c7621de4ae052f09d

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 02:06

Target

SaveOperate.dll
Size

89KB
MD5

9d7cca6ddfaf6e5353200b07365a474e
SHA1

dba1e692f8d30abb9ef2e41a0a330701a3610555
SHA256

ee37569f18268ad3189867f076fd2b3f9dcf016cdca92ad6a80f7798ac3e3f5d
SHA512

456dcca23d3515c4f7517357086e7ee3ef5b0f9aadc399824c5a12de27c292c7e1739d49f43a24cfca3aa1f5b4bfc456d898aa9068f4550698e009fdbad7934a
SSDEEP

768:uXc8P4o00m+CusjIlenL3iVay4lJLIhTozIo37PNW1zuageMU4p2FIvSR6uE6RMh:qci4N+COK2Vah+ToqqFL6RWovnFkKBi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2516 wrote to memory of 2376	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 2376	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 2376	2516	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SaveOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SaveOperate.dll,#1
2⤵
PID:2376