1a060d1dabd86e25cb6aab039a0fdccd176cb033e5c7823164b97b9284e34191

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 21:56

Target

SftTree_IX86_U_60.dll
Size

570KB
MD5

57bf106e5ec51b703b83b69a402dc39f
SHA1

bd4cfab7c50318607326504cc877c0bc84ef56ef
SHA256

24f2399fc83198ab8d63ee6a1ad6ffbd1eda4d38048d3e809fecd2a3e0709671
SHA512

8bf60649ece6bbb66c7b94ed0d9214fbeab030d5813e1e7b5d6d2349ee1de9075b7dfbbbbeae5af0dc21b071a00eafce0771ca1804e6752e9a71e71e6b1447df
SSDEEP

6144:+F1oCaK7hWLMxQqTxNEaPe/cq0sJBJYzlRtcChgWPQnjLkV3Ij9DvAmintVM:koxK7hhNN1m/cq0sJ/YzNcCj0oVy8Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2044 wrote to memory of 4944	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 4944	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 4944	2044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SftTree_IX86_U_60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SftTree_IX86_U_60.dll,#1
2⤵
PID:4944