ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd

Analysis

max time kernel
133s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 10:49

Target

scrnrcd32.dll
Size

341KB
MD5

aae12afb8b1efea2acf54585e98e642f
SHA1

4f90f8776c7eef0a1e8081bb83b0686cd512bcca
SHA256

2658fd793c96fa63d5d61308327c738fdcf62297df97d0128f8976067b22bf48
SHA512

2bf359acef95b6937793046e21c3fc1a4f2996c83869224a2fd3b92e5e5fe184918eb105af539dfce9d701119c16b97e391afd8a40d3f6ee58d73e4819ce9a09
SSDEEP

6144:folBD9sMAuabXHpo66P37Dv/rYBMXdD1bBQJ2+U55e2PTPGbLnYmGSGm4:foDxsM7arHp+LLDYBMXvbBQ/UXvTOE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3932 wrote to memory of 2888	3932	rundll32.exe	rundll32.exe
PID 3932 wrote to memory of 2888	3932	rundll32.exe	rundll32.exe
PID 3932 wrote to memory of 2888	3932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrnrcd32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scrnrcd32.dll,#1
2⤵
PID:2888