896fca5100c8a8c0b84908249cafa259654cf5eaf8191fa5da65d57b7b727dae

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 22:13

Target
$_2_/smfi32.dll
Size 654KB
Sample240516-145amaba78
SHA256 6dbb300c0e65f527a7ad55c4920588665b71e611e039aa1a14fa5df61ed704b0
MD5 4fb44efc16bdb28fb9e1b37d6a5dafdc
SHA1 554eb0669a8081537622d1084040cd6fe3d4d311
SHA512 21a3c3a44809be644345e6f9b599fe414a22307bc5a6c2118ce37456190857aa62b5afbbac89f96352d2280b8806aadb4457584e716d6329cb4158a8ec30a604
SSDEEP 12288:xF2AiJhXpp2ulZgMmxsqbRWJNHv/ZDUYBH9eA4EkB4WTh2X9EcUSoxYQ7:niJZblZ76EHv/bdkBjTh2tEcBoxYQ7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 372	2368	rundll32.exe	82
PID 2368 wrote to memory of 372	2368	rundll32.exe	82
PID 2368 wrote to memory of 372	2368	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\smfi32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\smfi32.dll,#1
  2⤵
  PID:372