68de812ffc84aaf4f7a5b3f7b55472f2a525fe43c60e64539a84506fcf386d0e

Analysis

max time kernel
132s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/05/2024, 04:40

Target

$PROGRAMFILES64/StartAllBack/StartIsBack32.dll
Size

563KB
MD5

e4b19c388cf6d649053e7f018388b9a4
SHA1

9114450f106c4e274c335f4e5d41fe40380a9607
SHA256

6405b9ad8b1557381de5a3d51502f408891283ba22ad45166343261e703bee07
SHA512

f990a6765a3bc8c3d36d8617e68237d83cd2cca4e05a71389f4381e6ef8b2c96cc9f04a6f9db74a9af95f30bfd36c72394acff8718e8ab6d16581eafd68ab51e
SSDEEP

12288:1SEyvDUMVQfYllJs97b3xrtlyXWM59+2cCGM7VxA:wEyvDUMVQfalJs7bhtlyjI2e4O

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4676	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4676	4512	rundll32.exe	73
PID 4512 wrote to memory of 4676	4512	rundll32.exe	73
PID 4512 wrote to memory of 4676	4512	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES64\StartAllBack\StartIsBack32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES64\StartAllBack\StartIsBack32.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4676