d618b457c1310790385c4efeb88e8afaa61876e42b17bc329bb148694a4b5a00

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 15:09

Target

$APPDATA/sys/Office/sbsmscordbi.dll
Size

5KB
MD5

6990ed64de8a5f23479dfd05f1de0cdd
SHA1

8fd707e26d7214a5c551be9bc3473395f7649941
SHA256

655acb02d6237813a5b2affc39f599d2467dbf4b565924c2b9673f07380c6f59
SHA512

46ac17c268e85a048865d3742d91146ef9b12f5bd62bf5a40633e8836dce0551b12109f2e39537e8eac53826640d77b70574dc5adf3bc0c1d0541fc48aa30e5d
SSDEEP

48:C0ytDmxM83ljSffOuE4PYrR18gFN3oTNFlIuvUtZWNHWHlx+IBSy7F5WWrn5j:7ytDin2mu7gJpONd6Wt0b+IBp7jWu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2588 wrote to memory of 228	2588	rundll32.exe	rundll32.exe
PID 2588 wrote to memory of 228	2588	rundll32.exe	rundll32.exe
PID 2588 wrote to memory of 228	2588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\sys\Office\sbsmscordbi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\sys\Office\sbsmscordbi.dll,#1
2⤵
PID:228