bab8b5e74ab7210b030316dd5685f3fdcceac35bd3b3a90e5dd01592f8abb630

Analysis

max time kernel
125s
max time network
138s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-06-2024 13:01

Target

NursultanNextgen2024/lwjgl_stb.dll
Size

102KB
MD5

b5ee40662104194eb904fd559d5e781e
SHA1

224a48ab7ba6fcdbf684ca841d059c9bd297376e
SHA256

2865f9df4a6635135fe40029e43e76e11287c2deb30e4b023c7acbfd896aca58
SHA512

35f61a019be990ab65316e03ca6de3691426da1d232d1caf90e0d8dcc3c020a7c6db13207fbbbad74b39b653740594a26a8038c43ce1d478c17090209b75962c
SSDEEP

1536:CqP4/ysXsu3E2BuY/5dCFegxqN9BBJ5QBJXM+ETV4JJARDeQfLpcI:C5/GYRdfBJ5QBJ7lC7La

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 604 wrote to memory of 212	604	rundll32.exe	rundll32.exe
PID 604 wrote to memory of 212	604	rundll32.exe	rundll32.exe
PID 604 wrote to memory of 212	604	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\lwjgl_stb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\lwjgl_stb.dll,#1
2⤵
PID:212