92853b65366d780bd7e3a7140cb645059f8faad7c70eacc8115a171baf11093f

Analysis

max time kernel
443s
max time network
449s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:16

Target

KMNV.dll
Size

502KB
MD5

de90de3280cfa528b57bc88df1015247
SHA1

3dc0fb731226b17a18e846d54bb98f7791cdffd0
SHA256

fe95318212738df2d895cea3eeafc64cffaa58dee25978af4efaf97f89a2f5db
SHA512

53ba54a3cc4d635bab35c3d75799635d299f74bae6129d3c4be6a8852daf96ab4ea495f620aae21ec6d067b8b058eeb681674bc1f878934ac93c38fae347bb89
SSDEEP

12288:E2WtJqpa4ksSkeDEIbQOTe9f3QL/LSDf3QL/LSn:XWtJma4ksSkeghYL/AYL/2

Score

1^/10

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4536	1408	rundll32.exe	83
PID 1408 wrote to memory of 4536	1408	rundll32.exe	83
PID 1408 wrote to memory of 4536	1408	rundll32.exe	83
PID 4536 wrote to memory of 4248	4536	rundll32.exe	84
PID 4536 wrote to memory of 4248	4536	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KMNV.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KMNV.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Users\Admin\AppData\Local\Temp\KmInst64.exe
    "C:\Users\Admin\AppData\Local\Temp\KmInst64.exe" API 0 KmInst32{667B7EEE-C130-4E06-9206-691270C84E6E}
    3⤵
    PID:4248