7f8ee260f5a6650c42992b658403c6db98fac6d3e552da6bef23a6a691e4bb9e

Analysis

max time kernel
79s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 01:58

Target

$PROGRAMFILES/$_120_/Interop.Shell32.dll
Size

48KB
MD5

5d79b7eb271ff308f08b47e03ff7a756
SHA1

74b63f41cca3e91fbf43b8fe28751159a1ad1030
SHA256

2119b6c748aa725847c28d2ee7a6908e23018ef4fc79f21257e88492d6a5ce29
SHA512

7150a42e383314dc70ee14eade0e1184d11d0e1133c24391ca18295151126a862f8ab452e3df098ec88662d2cd4c7731bb01cb933b74cb38c2c48943e12e6314
SSDEEP

768:fexl81nX6ZxlvUAa7KoBv7epginbCe7AXjuw9tL0Duxj7tr+Br7FHy:fexl81nK34PJepgqcVz8y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 2664	4312	rundll32.exe	81
PID 4312 wrote to memory of 2664	4312	rundll32.exe	81
PID 4312 wrote to memory of 2664	4312	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\$_120_\Interop.Shell32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\$_120_\Interop.Shell32.dll,#1
  2⤵
  PID:2664