06aa393ec4cef895ebbf9923200f9f5d71df6ae27f091004c89176a92825014f

Analysis

max time kernel
129s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:39

Target

Modules/cus.dll
Size

102KB
MD5

afebf92fe3ceb4ad86cb806d6aaa0d7d
SHA1

1d9e7c4b8c1d938bca48dbb8edb53b6f34522ee4
SHA256

efa1abf8a7d331681a20739e362f8a0faec2fb8f8bcc7a7f2e4ba76147fbf4a5
SHA512

8c910f690f97200203fc4820d19a70bd51afc5e3bebeafe3107453eb6bc71166b152b3bb2f82586d3e06b9930a1be12daf43434ab763087792e3e468d563b581
SSDEEP

1536:J7PSVQhAoTtwAjjk2Ve9z7BvFjuJfCv6+LSEYxQcetvch89lVsmU79tjHOCshOi0:JD+807BvFjuJWVVY9ICshOIbZDa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1624	1268	rundll32.exe	85
PID 1268 wrote to memory of 1624	1268	rundll32.exe	85
PID 1268 wrote to memory of 1624	1268	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\cus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\cus.dll,#1
  2⤵
  PID:1624