94a47191fb3a307fdaa84a1f8f31d8e1b4b79b34048814725c373e54f3d4e37a

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 10:20

Target

gdi42.dll
Size

2.4MB
MD5

925373c5522569c053ae3ff9a8879a40
SHA1

8e18a8dea1add62d9fb56414dfe42fc1c04b2505
SHA256

57d7f0a0290fbf80d2b3399ba102df384fbc27edaee77fec86a5c106f4bf8429
SHA512

2e239ba0fbab72d7bfef07746e287ac359341b5f96d14b754e8a16165da542ddb5431feb044ebb6b7084a06a33e65ff964b1cc2da9a6f2be0eb4a9a38b39278b
SSDEEP

49152:a32ZyJzUX/MFfg9VjDbEopttbynqFB4taEnC7aHQkd53u0wTSPiRD8qw:XZyOX/F9VvbEstQqFfmC7aHQkdI0wTSa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3932	1044	rundll32.exe	84
PID 1044 wrote to memory of 3932	1044	rundll32.exe	84
PID 1044 wrote to memory of 3932	1044	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gdi42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gdi42.dll,#1
  2⤵
  PID:3932