767091a7c1294e9909cf14424ba538fb3a40569d4a1cbb86ffeed199e9745328

Analysis

max time kernel
54s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 19:30

Target

ref/win-x86/libusb-1.0.dll
Size

132KB
MD5

7bbf88cd0d3a951d10fdf9528ba358ad
SHA1

93475754b183f85a67961a3932b29c749d396faa
SHA256

eda7ec675e1502f725eb325e696b3bebd943d60e10dfdf0f739fe8f9dcc2d524
SHA512

43cdf05730e9fca4e995b30352c4a507e5f8fc4ffab3a32ce953ea782481b703a6bf60bb96c054da40a00250672127407dab0cc70ac6c3f41a134ee263a0c8eb
SSDEEP

1536:VFsnZMU9Nq64MvQSJDgXruk46zgT1awkr2SaL66/13otReS4yiGaPYmK:SGU9NyMYKg6ka1krTF6lo/LiGaPYmK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4784	3696	rundll32.exe	84
PID 3696 wrote to memory of 4784	3696	rundll32.exe	84
PID 3696 wrote to memory of 4784	3696	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\libusb-1.0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\libusb-1.0.dll,#1
  2⤵
  PID:4784