8bfcd79d81d878a298d717aa629b6fd0eeefe9d260b336637b3d1c9022997cd6

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 19:48

Target

DMStartupWizard.dll
Size

361KB
MD5

958470a2ff78b805ce4723a4f1a1914d
SHA1

a45a61aff412899dafacd61127d1822bc040f5b7
SHA256

cf8bfc2ec85f9dd1d309e052ef23e167e20c54239def044d47f6cd36dc974bae
SHA512

b9a5c312b4b8bb8bc623ec00d438f90f3b4d07cb0284105bd82cdbfbc7726aef8e4059327e92b7951590830b40e7f95bf623558dc1466f3f689e8f96d020dd4e
SSDEEP

3072:MvBhvBjvBzbDynVr0820q+8G9US77nL7H7V0/LekGpwF92vBwZX6JPD+PjVM5KQj:aPtzb2RrDjUwjnZie5GswZq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2952	3564	rundll32.exe	84
PID 3564 wrote to memory of 2952	3564	rundll32.exe	84
PID 3564 wrote to memory of 2952	3564	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMStartupWizard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMStartupWizard.dll,#1
  2⤵
  PID:2952