68b729d1c7e6b424b230931dc74db2c90c08d4923130582c80a295e144dba43f

Analysis

max time kernel
135s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 16:35

Target

$COMMONFILES/nProtect Shared/Engine/TeCtrlu.dll
Size

612KB
MD5

011e06592f5db69ca87e81d3fa7cb87d
SHA1

16eea985ef42f73d05d6a2521af359c74d2fa2bb
SHA256

fe76994ac78ae51d76c7bd3c418941a90f1651875cba264d69af22865624b501
SHA512

fd79d669a4225a1321dd560b3eca31fc4c204961837dbb7b7dddfe4507b4a5b5041545cb6b861bd3fec24f266536e143d6620292721ecc3a818fac572237b167
SSDEEP

12288:KG/VV2ubBYzGTiWe4mk5SViBoUgOaxStyYf8MWyw+64Jb:OCTNKyogaxSkjlyw+6Ob

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 1232	3344	rundll32.exe	84
PID 3344 wrote to memory of 1232	3344	rundll32.exe	84
PID 3344 wrote to memory of 1232	3344	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\TeCtrlu.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\TeCtrlu.dll",#1
  2⤵
  PID:1232