6bc73333bf9ae12bdcedccc1ecd28acfc70f2b17d95c55d67e87100ee6040572

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 10:22

Target

$TEMP/paratrooper.dll
Size

64KB
MD5

6454128223fdb4e7177ba6b89e935784
SHA1

26b6388a297f9286ec5788bfb752223a1cbf5eb5
SHA256

9cd07c670e452c1728cee3415eb033a78a213b48f1a0841d5a104542c52cf9e7
SHA512

05790d6c405e0b147d66ab7e23757923145bed3e57714288fc7ea74670f012114b1c77b0f479e329c072045d33f7e4bb9f288424e4f65571e8bf3efd1482b829
SSDEEP

768:jDNoVwuc8EzAk/13pi9Ihg9r+1KU7CZHxkPR3JBZPXPEeZz1VtvpTDJorp:FoRc8iaIK96wUeQPXnftxDa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5052 wrote to memory of 2024	5052	rundll32.exe	rundll32.exe
PID 5052 wrote to memory of 2024	5052	rundll32.exe	rundll32.exe
PID 5052 wrote to memory of 2024	5052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\paratrooper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\paratrooper.dll,#1
  2⤵
  PID:2024