d910030e1f0562ef78edc8f82d37e1d47ba9dbb7048086d857a1a633c24eb994

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 18:05

Target
xptools690/WinRing0.dll
Size 64KB
Sample240705-wpdrxaverg
SHA256 8edb4338883cb12d730ea1827c8e232b4a1562e207c5af26b0d8d86e4b3f2269
MD5 3efa8f1865595ebe1dd415025bf17d8f
SHA1 c37f9c5fc06bd1ee8a0a7694f378c0cdd2eb4484
SHA512 49b6c8a4005f4f2b61e57d373bc74ffef715d174ed891a73502e2cc19f21c59293188cda364fe86b2bdcd1dc9d97562cf8b73449ce715ecf285c964628cd5764
SSDEEP 768:hRPlqAVzcRDoomqfLYwwvI+Ps8qyOTtvPPzGVojF:jPlA0ogw+PiZtXPzNj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3212	2192	rundll32.exe	84
PID 2192 wrote to memory of 3212	2192	rundll32.exe	84
PID 2192 wrote to memory of 3212	2192	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xptools690\WinRing0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xptools690\WinRing0.dll,#1
  2⤵
  PID:3212