bab8b5e74ab7210b030316dd5685f3fdcceac35bd3b3a90e5dd01592f8abb630

Analysis

max time kernel
129s
max time network
141s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-06-2024 13:01

Target

NursultanNextgen2024/SAPIWrapper_x64.dll
Size

42KB
MD5

97ed307c26244e7e845a8e888099eb6f
SHA1

03c2989f7f633b56417c7831f53aeeb20065f61b
SHA256

43ca444fb76e71bbbb34b85b8ee6bda6f1cb5c9c29747d480b9dc3dc79435999
SHA512

155c460544b281c176dc75c497f96f168514b5fae746b9b946c96096558cfe00cd5bbf4eb7132bd5b9ce9836a3bba54d1d8299094ca68b8b42ca7fd5cee4801b
SSDEEP

768:aGucPfgSPYXYqo3/nDn6lllVsuScmgVJqGPMgBHHH:aG1XgSAXm3PHuScmgCGHpH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3224 wrote to memory of 4460	3224	rundll32.exe	rundll32.exe
PID 3224 wrote to memory of 4460	3224	rundll32.exe	rundll32.exe
PID 3224 wrote to memory of 4460	3224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\SAPIWrapper_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\SAPIWrapper_x64.dll,#1
2⤵
PID:4460