68b729d1c7e6b424b230931dc74db2c90c08d4923130582c80a295e144dba43f

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 16:35

Target

$COMMONFILES/nProtect Shared/Engine/NpBWT.dll
Size

210KB
MD5

d6166637f37a4bc6feabbcbe33cf6998
SHA1

12099809dcb7344a11bf717a4ddeefec779c805f
SHA256

caf01c6662775f5a7703e5d2a7aa65308c9067d572bce44bc08ee4ee623fe6ef
SHA512

6e940b433782489ad5ab24ebbcfca1cc8e21bc361f2f35a2356298d35aa94c6bc902710903d6fc11cd02aff9a73d812a5eeee9d460e99cd7fa82c24b5527b888
SSDEEP

3072:IETUFEWHVvVBlzzRsttNKECfjRvWmBRfrvTG3/CRkne+K84zmtR:IVaWlVBpzolCf9e8VvTjRkeA4zeR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1412	824	rundll32.exe	84
PID 824 wrote to memory of 1412	824	rundll32.exe	84
PID 824 wrote to memory of 1412	824	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\NpBWT.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\NpBWT.dll",#1
  2⤵
  PID:1412