f38d5a714aca773568eb1c77492d09353cf060ddafb86b04dd6e090c09b985b3

Resubmissions

10/05/2024, 05:18

10/05/2024, 05:13

max time kernel
135s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 05:13

Target

DeviceDiscovery.dll
Size

45KB
MD5

25ae29a7cdd6f24aa0d488973818bb9a
SHA1

2981bf3d0aa49555efa99a920ad408771c79b680
SHA256

d0e08b92d51911b6d909449c33a14106f25da89b4a9ba810688a6c17638a881d
SHA512

89d9c600dafeaeba09a56999ab638c26b541efad0939cf120360edc4c36cce34ed9c0c455717d8762dd47da336f6a9948d46203566edc6b44a09f6a1ca45738d
SSDEEP

768:kG5VZd9FMfjj2EVLVENsVhRDnISUDludbQVWjqyLHno4lvmY8CFBhpoRfuiLf:HnabSQqyro4JbBhpoRfnr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4756	4916	rundll32.exe	84
PID 4916 wrote to memory of 4756	4916	rundll32.exe	84
PID 4916 wrote to memory of 4756	4916	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DeviceDiscovery.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DeviceDiscovery.dll,#1
  2⤵
  PID:4756