76238af88d9a95bd3c17b150465d6dc8f0734d9b25670d8bd10d63559a55b615

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 06:53

Target

DMStartupWizard.dll
Size

361KB
MD5

b5657fb4bccab65b1a34734948ff6c1d
SHA1

edea291922d02536f86e71dfb498adccb4b70cc1
SHA256

b73ca7d7a4d411e29856594ce0b91d6dbbfc61d5e6274ce40c7261109a133882
SHA512

118aa13004adaa8065e13481277284fd6aef27518526e298206bce44a1e684f7bd4170bf2b483eab8694519ef2d612a959fd85645d14816c7032d6256897a1e4
SSDEEP

3072:QvBhvBjvBzbDynVr0820q+8G9US77nL7H7V0/LekGpwF92vBwZX6JPD+PjVM5KQI:2Ptzb2RrDjUwjnZie5GswZq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1536	4476	rundll32.exe	82
PID 4476 wrote to memory of 1536	4476	rundll32.exe	82
PID 4476 wrote to memory of 1536	4476	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMStartupWizard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMStartupWizard.dll,#1
  2⤵
  PID:1536