68de812ffc84aaf4f7a5b3f7b55472f2a525fe43c60e64539a84506fcf386d0e

Analysis

max time kernel
133s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/05/2024, 04:40

Target

$TEMP/STARTISBACK/DarkMagicX86.dll
Size

127KB
MD5

7162f62910e6c2e0c964b5fb765170c4
SHA1

e847401f6ff87e03b9b71166562c0beeb0850b72
SHA256

d68d7e9d4e6ecaff194fb461098fb93ca142b81881400c3e7a05eb0ce10a3b3a
SHA512

37e85e498f8f78079d61d0ed3efcabbf3007fabe3ce5b45451e246a305d86c3ca4bb71b4e20b430441a5cfc7505d53cb3ca33e53f70ee2e1abdb3f837e129664
SSDEEP

3072:qQ/dazpCv9KUoQEt3gUYhvFPTBsZAC4TBZv7Sx7y2Ifak:qQlazpGoUohwhvZTq4TX7Sx7y7ik

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 928	1208	rundll32.exe	73
PID 1208 wrote to memory of 928	1208	rundll32.exe	73
PID 1208 wrote to memory of 928	1208	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\STARTISBACK\DarkMagicX86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\STARTISBACK\DarkMagicX86.dll,#1
  2⤵
  PID:928