26fd5b5e89765a8fa12267cbd102669584db0bf4e58c97e738ed28e0432519eb

Analysis

max time kernel
91s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 12:53

Target

SystemTransform.dll
Size

204KB
MD5

aa99f5a945c2e8f54c72523882ed8c67
SHA1

bd985847e362ec1dadadbd7da1f4d55acdb3466a
SHA256

26fd5b5e89765a8fa12267cbd102669584db0bf4e58c97e738ed28e0432519eb
SHA512

39554aaf36988a14738e88ba88d533a10d8e446ff12dea8eb8adef267a2222067bc972d410e048546a0030ad9a66357bcead17294d1d1b04c0a913d64af11663
SSDEEP

3072:6mhedc5OQ+revqFCDjbCGZ7/6VZuiictmGCIGyxhu3aTuPCzbif+8rR:hhedc5OQ+reWCuGZDMutGCIG8U7G8F

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 4084	516	rundll32.exe	82
PID 516 wrote to memory of 4084	516	rundll32.exe	82
PID 516 wrote to memory of 4084	516	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SystemTransform.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SystemTransform.dll,#1
  2⤵
  PID:4084