767091a7c1294e9909cf14424ba538fb3a40569d4a1cbb86ffeed199e9745328

Analysis

max time kernel
66s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 19:30

Target

ref/win-x86/libusb0.dll
Size

63KB
MD5

f306d40c3122579ac4af973deb5650f0
SHA1

5676a8ac46e15793de65d9bebea5f636f9953786
SHA256

48b0d28840232019be8b56f88dbe1a544718431af4e5b7771673eda9fed4ef94
SHA512

ec3a42cda54a0a855500a0c5f5154f49c5965fcdc4cbe4f8efc0ae9bff0694f931c887026f8eebf8c41b496e9b6f55c6a54fdd89707c725985bbc580626121b5
SSDEEP

768:Bm7/H0yrNKmMG1tGXzjdDuJ6mRt35xFh6DLFTGEfkjdH+hcjRDZ6mooVRA5Yl3Lb:Q/Cmr3GXmb35nh+T0JQcR1oMRAGl3KY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 684 wrote to memory of 3916	684	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 3916	684	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 3916	684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\libusb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\libusb0.dll,#1
2⤵
PID:3916