2d5db17bbbb72469b53f2c1801e27e79a2dc83f266ca34710e4689d0c7b03cf6

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 02:30

Target

Geode.dll
Size

7.6MB
MD5

67c1253572cd9d7a9442f588ca1a661d
SHA1

12a7863dff42c3e1a7d2ca394446050e5746657b
SHA256

e1aaf9bd013eb8f3ada9409365b40a92d7b81bcd44edcdd06fed00791594dad3
SHA512

ac0f24541ff4c44fb7599159e6ca8f2a37f6c59c7edc2ea8aeac82d08baf957a9e77edac4fa9461865207281188f8b92dc3caf1be85bdd0f84336b0c037d54cd
SSDEEP

49152:JuOIJaCPplBdJxCeaevXDP7IUgGdfIfwIhxmIXUnksV70pg9ToPchQ0w4UpOF83e:zMa2pZdfIbXUksv9Td20w4UpOF83

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4996 wrote to memory of 4064	4996	rundll32.exe	rundll32.exe
PID 4996 wrote to memory of 4064	4996	rundll32.exe	rundll32.exe
PID 4996 wrote to memory of 4064	4996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:4064