92bcdebae7c9e0a1bdc66b5cba95f9a3dd5504d16e92005ca6019564d4b6b7de

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:55

Target

DismApi.dll
Size

771KB
MD5

730948b0cbb925097dd840987d2a9e93
SHA1

f76e6be9b0e989bb7410e04aa22285e1ae475247
SHA256

92bcdebae7c9e0a1bdc66b5cba95f9a3dd5504d16e92005ca6019564d4b6b7de
SHA512

680b0ae20921b2cc677cdfcf588b0f55fa43b0db886c4f53c7162285f72707b853176a6840f3c110d1bc81675d79a67a3633a5ebef02024af8e8b05de7f40472
SSDEEP

12288:HeAIIPZdSvWKUnf+clG4km+XjFgErcpHaWoabqHJDKRl9kF+Zr9kYV7a:9IUZdSvWKef+clG4B+XRgH1i6n9kYV7a

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3568	3816	rundll32.exe	82
PID 3816 wrote to memory of 3568	3816	rundll32.exe	82
PID 3816 wrote to memory of 3568	3816	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DismApi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DismApi.dll,#1
  2⤵
  PID:3568