d910030e1f0562ef78edc8f82d37e1d47ba9dbb7048086d857a1a633c24eb994

Analysis

max time kernel
120s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 18:05

Target
xptools690/inpout32.dll
Size 96KB
Sample240705-wpdrxaverg
SHA256 01bcec6ddb4964e1f5b69ba1bd3876221d8de7ae17cacfac66f095013434a78f
MD5 c1ccde650bf91a3b1d07dc5494d4276f
SHA1 8062e3a853769d4c8235d30b30ca97cb200b1479
SHA512 83c3ad41ab7b35e7116208dbda9fc65ad6203f5922c3ec5e840b0c54c5d2c47127564c0ec88b3445d5563fa39cca0ac62a6ca5603118e317523ae822d06e897c
SSDEEP 1536:o/Y+Lhxv0hDuC0+5/CH8KM3xtGQI0jqSG0jVf:ozL7E/fhtGQwSR
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\inpoutx64.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 388	3628	rundll32.exe	85
PID 3628 wrote to memory of 388	3628	rundll32.exe	85
PID 3628 wrote to memory of 388	3628	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xptools690\inpout32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xptools690\inpout32.dll,#1
  2⤵
  - Drops file in Drivers directory
  PID:388