127d0ac85b6832a43bd748e85a16fc0e450185b475893f87c2b5bfb8ee49f9fe

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:50

Target

ComposableShellProxyStub.dll
Size

148KB
MD5

2bad86c420a01114f760b155dbcec968
SHA1

2c8188ad68595107124aad820e396853e234e105
SHA256

127d0ac85b6832a43bd748e85a16fc0e450185b475893f87c2b5bfb8ee49f9fe
SHA512

120ccb13e4810e5fe928716ac075ee2946a43254356a3a5e198eb2a9a7caa92e3355b26e1dfc0b0420f214662b05c6f7d7dd65b3456fe86f5120c33558cc72c3
SSDEEP

3072:8I/GRfdQUWEkXrOlb8CAnLtirjdsm3NKbO4Gj4A4fMhLkoXK0hHdN4unmkVoWNuI:mXFCY5cM3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4476	3472	rundll32.exe	85
PID 3472 wrote to memory of 4476	3472	rundll32.exe	85
PID 3472 wrote to memory of 4476	3472	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ComposableShellProxyStub.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ComposableShellProxyStub.dll,#1
  2⤵
  PID:4476