bab8b5e74ab7210b030316dd5685f3fdcceac35bd3b3a90e5dd01592f8abb630

Analysis

max time kernel
130s
max time network
141s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-06-2024 13:01

Target

NursultanNextgen2024/jemalloc.dll
Size

111KB
MD5

726d3ca3bf8bc182bffc9cc126c243ed
SHA1

78f043b314a7c8573e6fff69dc558cf1126af225
SHA256

c708bc4b3015403a5240bd949bc6b98df97c0cfcf5a9a269e7999c4726b76cbe
SHA512

a90bdc4300e3bb72d0e0df072c97cfd380dadfe3e14117616ee9a282865a696b7c5d238363fa472305c936c44449fe751cc4c5ad7e11b85d3a8faf2380a76736
SSDEEP

1536:/tUU+1voe+krM51raaETSNBh3okitp6TflKE/lyfW04fEL9Y59C6:b+ZUkrMuHTSNBh3okitQj1lyfWSGu6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3188 wrote to memory of 312	3188	rundll32.exe	rundll32.exe
PID 3188 wrote to memory of 312	3188	rundll32.exe	rundll32.exe
PID 3188 wrote to memory of 312	3188	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\jemalloc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\jemalloc.dll,#1
2⤵
PID:312