fdbff013b835081580756a378afeb8c6897a345f6934fa54d1c71ade4d15fe7f

Analysis

max time kernel
130s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 02:44

Target

$APPDATA/rss/spcustom.dll
Size

21KB
MD5

dd4deb6fe0c79cdd79be1d0df958cca5
SHA1

714bbf446b36a038c179d3388d346cd56c57aa38
SHA256

51e233e832d97b7daca2fa9352d84b1e3450b2c96eb8a8e92fde1cf0b7c4f925
SHA512

df90fc7eeac91a2d23b497c71a9d0cbc66faccf12fba9b83d09ad178a784dbf77a488b7a3c31cdc63d37108458921881c00db22761ee854b54006457dc29696e
SSDEEP

384:qfuGBG9yKK/ukfT3/zZh1qS5v2E5G2zfHAniOYl2Ubjrw448RJpWi2pWGGPH5LC/:qfupkKBCTrZfB+GgiO6TJIKPZL3d/o+y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3592	4472	rundll32.exe	83
PID 4472 wrote to memory of 3592	4472	rundll32.exe	83
PID 4472 wrote to memory of 3592	4472	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\rss\spcustom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\rss\spcustom.dll,#1
  2⤵
  PID:3592