3133691453d52deda0e443d99f1565178e629a2ba4b31137bed01916b5b831f0

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 06:46

Target

$APPDATA/vehicletestdrive/_tmp/crtowordsen.dll
Size

17KB
MD5

6aa6857e3aa855c208328a94e2979061
SHA1

b7d4304bd485f5ce8ed0183d57141c06bbc321a9
SHA256

6bc72ed8ef1f94b662813efec2f24886b1031e202581c20904c9aaba4c97584e
SHA512

9636495b0a7a0f10c71b07aad97350d1c48b98907674081d40021c80ba8c068f2a9492a3563a93a07c5fb7f3bc380c41d529b49c0f04c154d682c14adade1fa7
SSDEEP

192:ZHa7LAQiaLVaCQODYp8eZQd2SK3Xz7Yg/1LfzL/CldolMvMjGwPyMojT+KzVMiDA:BoL4aLVfGjv/1LrLCcY9jBJJU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4792 wrote to memory of 2440	4792	rundll32.exe	rundll32.exe
PID 4792 wrote to memory of 2440	4792	rundll32.exe	rundll32.exe
PID 4792 wrote to memory of 2440	4792	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\vehicletestdrive\_tmp\crtowordsen.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\vehicletestdrive\_tmp\crtowordsen.dll,#1
2⤵
PID:2440