bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:31

Target

MedicareSign/opus.dll
Size

361KB
MD5

82e49683f540f78b2d1759cde594482f
SHA1

352dcbdbbb3c5c927b83389e2ab7f40b66ee716a
SHA256

55d99ecd7f821a4b2fe7e5a0b2cea213dc79004c1dc413bd003f032c61080576
SHA512

f50a3bcd5905103eec344d7daf1c17896df9039d3e8d5e9bbd771f1e235ec6045d626ed838c9bf3a8f7a66aa5f41f0743ea7d9bdef7492da8b36561089e126bf
SSDEEP

6144:wJ9LiOhPhz85popbbFb06wAQAwq961b/v9MkvCq2/JO+UxK6DvX0C7Uxm//f0Ps7:IBi8q5po9JkyICq2/z6DvsyEE5+PgAEX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1096	4892	rundll32.exe	84
PID 4892 wrote to memory of 1096	4892	rundll32.exe	84
PID 4892 wrote to memory of 1096	4892	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\opus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\opus.dll,#1
  2⤵
  PID:1096