e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 19:54

Target

$TEMP/dxredist/dsetup32.dll
Size

1.5MB
MD5

d8fa7bb4fe10251a239ed75055dd6f73
SHA1

76c4bd2d8f359f7689415efc15e3743d35673ae8
SHA256

fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
SHA512

73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
SSDEEP

24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DXError.log	rundll32.exe
File opened for modification	C:\Windows\Logs\DirectX.log	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3680	3936	rundll32.exe	84
PID 3936 wrote to memory of 3680	3936	rundll32.exe	84
PID 3936 wrote to memory of 3680	3936	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\dxredist\dsetup32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\dxredist\dsetup32.dll,#1
  2⤵
  - Drops file in Windows directory
  PID:3680

C:\Windows\Logs\DXError.log

Filesize
238B

MD5
eab12779f3419de16cc688237acce8cd

SHA1
7f1cb82a3c9d1511e34b99fc3b148efbd9a975e7

SHA256
bb550b9f70f8f2fca7716f0c6354a339ecef25f22e1ccc62fc0f7266c5d48ba6

SHA512
f65288b1809d80b33f4e34e3344e7f133c52feee1efb0cd754027816866ffd14f54f28db4797b518cec5b86f7572e8cd039220280b676208e23b1d3032393ad6

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
679B

MD5
e1e137c892d52db45c19408acd99c506

SHA1
8017020e8597d0925c04d97b647f71190b67e140

SHA256
4b246048c7d3276d8e854deabc98e995269fa9c452fc86137d703bcd16bd95da

SHA512
c01b7205c84183ec2510521cc8786ab70a4c35f5f5a31e028752eb0ac8da3fa830fe2b2923691d3e02a6ea3440aedf2c8030c397037740052b1810d251f2a308

Download Submit