025ca9a56a4ab20702dd386fef1d2df311646fb741841cc64d70d37f84468876

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:31

Target

DriverInstall/PDown.dll
Size

207KB
MD5

e36dd5b451007790baabb9769de09a13
SHA1

ee5fb9e7ddbf5f269565531245edd682ef9fd7d3
SHA256

e648eca1c4d64f862e81d2f32533c6209acc215ab163fd72c5bb254ccf4d161e
SHA512

0bdb80ba39bdc950ad76bfd2c24fb1c244c6d0d576c52c1c48515d5f68c2db0de446dc720dcb07e1723cbd5f69e63a20d6133be8f27807aa585eedbefa4b188d
SSDEEP

3072:2b3IJqma3w9j9tyH2EHsOt75JyO0+n+z6LbKI/4kt6FyEbyG5tgMcYs0:2bYJqM9j9ty3HXqO0v2fKc4kt8lgTC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2684 wrote to memory of 2960	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2960	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2960	2684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInstall\PDown.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInstall\PDown.dll,#1
2⤵
PID:2960