fdbff013b835081580756a378afeb8c6897a345f6934fa54d1c71ade4d15fe7f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 02:44

Target

$APPDATA/rss/sbswminetutils.dll
Size

5KB
MD5

a692cab78e2cd9231dc99c9a0856f92c
SHA1

21fcfee7969bb94f40483385ecf8155f0d854523
SHA256

20958bc68c0bc83527e506e9f9502d9adf1d878e67c97468c0daefe291b6feb8
SHA512

17e15684776a2793e68ce12ed32830482bb80fbbf5fdb4ad5169b16350ec2481540f03f6d8025c0c55c9a39356b79df80f68a103cfdb90d8bd7a0a02c1725c16
SSDEEP

48:C0ytDdk88Lf6uE4PYPF18s42oTNewuvUtZWNHWHln5IBSrSRK5WWrn56:7ytDdf+Su7gPF42ONc6Wt0d5IBdRaWP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 916 wrote to memory of 3808	916	rundll32.exe	rundll32.exe
PID 916 wrote to memory of 3808	916	rundll32.exe	rundll32.exe
PID 916 wrote to memory of 3808	916	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\rss\sbswminetutils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\rss\sbswminetutils.dll,#1
  2⤵
  PID:3808