8a5135713c1a6688b790f11fcfc9153ebb442cee6aa69ecff9e6afd097068a66

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 12:39

Target

TIBASE32.dll
Size

78KB
MD5

2cb4f99812841f5271ea9fce41dddb46
SHA1

f4cb27de41b7c4138c1438eb79a4f3468b56f57e
SHA256

9297f69236b296238096baa1e9d00567fc74409b5a7ebe2565da71b27fcdc5cb
SHA512

e256da1350e600707a961ec155d6c34bad21a08fc5b7d8b14defe70b018a1473e5dc1cebe05139b902289bc995953db86139a64e6e0ff06bd62d85cf7654346c
SSDEEP

1536:dooDQcUggtmHXBdDho9gjTpGg6cytqy7X7ND/eqJpyqsJWRaFuMAn35ggjBL9:dkcUgtxdVo9gfpGHtX7NbzsJWErAn35J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 628	3628	rundll32.exe	81
PID 3628 wrote to memory of 628	3628	rundll32.exe	81
PID 3628 wrote to memory of 628	3628	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TIBASE32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TIBASE32.dll,#1
  2⤵
  PID:628