d618b457c1310790385c4efeb88e8afaa61876e42b17bc329bb148694a4b5a00

Analysis

max time kernel
92s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 15:09

Target

$TEMP/lg/fun/Links/crtowordsit.dll
Size

18KB
MD5

5e1f8c9a977a745493e8b8bebb2a676d
SHA1

870d420a553e5b91601d6a39cad33e98751d5816
SHA256

14068930efce35318db559e951978a4da2b24479080f16af99bd206a8a432961
SHA512

e3e38401bf3e2900ad8be245528fae1da9a4eaf40df83f87e2d0a9a08167601467daf3fd489a3b5bcd1186fe8ea318f9bce92e9361a00b859a3ae46e467b83fa
SSDEEP

192:ZnPcXAAAVCfPl3p6aU62SK3Xz7Yg4j1LfdAL/CldolMvMjGwPyMojT+KzVMiDM5R:iAAft3aVjvg1LuLCcY9jBJJK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3960 wrote to memory of 1436	3960	rundll32.exe	rundll32.exe
PID 3960 wrote to memory of 1436	3960	rundll32.exe	rundll32.exe
PID 3960 wrote to memory of 1436	3960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\lg\fun\Links\crtowordsit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\lg\fun\Links\crtowordsit.dll,#1
2⤵
PID:1436