c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
147s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/awt.dll
Size 1.2MB
Sample240603-pypr7sgc32
SHA256 6de97887ef757876ddf0549bd041a96bb32a040652a82e221bf7e4c8fcb9b5be
MD5 0fdda4763c75e78f25e415440ea789aa
SHA1 efb4fa000e34a253191795638a6ee657ef071215
SHA512 c21ab179b97f0ea1b27a6cd31651cc8516b921126c44ec44f7fcb240d614d8907168c1c068bf0a4d420141e2c91c636f769e6f1a067b4dcd7d8aef8384bf0a02
SSDEEP 24576:+4PUQluG1lXO0QlgXCh3Rg66HaWP2RxKGStUGAPOzW46jtLML:de0QlgXC3g8WPF8POK4kpML
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1664	5100	rundll32.exe	84
PID 5100 wrote to memory of 1664	5100	rundll32.exe	84
PID 5100 wrote to memory of 1664	5100	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\awt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\awt.dll,#1
  2⤵
  PID:1664