d4164b1dab1337e28d3ce097a32b8635c893e1acaaf7136e745b90c44ee2cf05

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 02:26

Target

Squall.dll
Size

480KB
MD5

e4450e7fd70c4c576a299b5ba945dea7
SHA1

f6b57a3566136074f55e4ced67e20f831096a15c
SHA256

712eab657dd5b2b50014a4fb678f69ab1ef461215d68f7fe621f048ec5da5021
SHA512

66bc907f031de9fc85688cf5717005a639affe44c93afbf499bec477332a2001bd2f186f6beefd866ba1533ed5f26a810f8b8607dc82ec707f5fc1b6e570568d
SSDEEP

6144:bo/mdugIeuLAoakz1bxJ5zwe7RCEtW+zn/eWv5LpTB3/V6MTmiW5hUyrddfrR0Zy:bokYAoakz1H5zv97xpN6oEsyXV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1612 wrote to memory of 1916	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1916	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1916	1612	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Squall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Squall.dll,#1
2⤵
PID:1916