f457caeb3fedec72b6d8ab1b6bfcf3cdb11e0c4cf07dee53f659c1e24de7f733

Analysis

max time kernel
136s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 07:17

Target

$TEMP/public_ftp/VSMigrateUI.dll
Size

15KB
MD5

8a5d7b38d9bdd2d1c69a0e93147406fc
SHA1

543d2409257eeba9387bc281f100adf5dbc77966
SHA256

6a0062f006f1eb13c641a841b7dabf7dbdc810f946bffd9282f72141a72d3bd3
SHA512

e3b3dcb12986995cb943a449ae80acf48ba6abe7e35673337595f919f9bc821313d35c4708657461c152cf36b1aa29c9ee32b7c9b8332da9b90b4ed2297e9150
SSDEEP

192:lZxn3fUnucJHN3Xz6vrk9l4cWLAwYWep+/WWqfkIL/CldolMvMjGwPgMvws+ebMg:xP6D6ml4cWLAwNes/WjbLCcY+wCbsOF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 556 wrote to memory of 4448	556	rundll32.exe	rundll32.exe
PID 556 wrote to memory of 4448	556	rundll32.exe	rundll32.exe
PID 556 wrote to memory of 4448	556	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\public_ftp\VSMigrateUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\public_ftp\VSMigrateUI.dll,#1
  2⤵
  PID:4448