8bee452d2535953e7ad9d18fffacbef60560fc05647c735ef55393c0869b673d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:32

Target
files/wbxtrace.dll
Size 103KB
Sample240620-byeeks1enh
SHA256 9e2b2d67d0e70651a64a3febee9f2698d8a939633587fe973a30758368cffc04
MD5 c2b06a78b6c07a1371b6aed1dbf4fc37
SHA1 b8847693e7cd3637b1b400e71430cdf629de2e64
SHA512 219965e4b3e9f237f75d9306bdf5a08c872cded973009da64c58221e1bbdbfda35e4861c4c0b6687fca7c67ef496b307695af5e1270f8d5c3cf71a3fc02c6411
SSDEEP 1536:HAIwJ6LSNBZVrzq8HpWt6/wwmSM4QnToIf2TuU/huhAmJ8dDUfH:HnSNBHUt6/wSM4kTBf2iU/huhFJwM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2972	1616	rundll32.exe	85
PID 1616 wrote to memory of 2972	1616	rundll32.exe	85
PID 1616 wrote to memory of 2972	1616	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\wbxtrace.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\wbxtrace.dll,#1
  2⤵
  PID:2972