561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
311s
max time network
389s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Target

PROPAMAT/FlDTE.dll
Size

24KB
MD5

1b45a789de212c96bbd92033a3fabc0f
SHA1

8e32e07febb511fd093604a3f17b3f6a4d22a464
SHA256

617ae663ab3b4d019d474d26e322b9db68b3f8e27bb92c9def8a91aba35f4509
SHA512

01606ef7f8641dc674f18e0ad7fc63159c2883249f8d1b3ba8f909e4af17aedfa9cf6e074cfd66424160cbba96efc5a7a527c7ac96ac84ea2d6b19e9c7700712
SSDEEP

96:Kepiqq7Gg8K3wszxpt8tyJuOScUDZMnZE2UIUYlnlYJnLEM/m+hLqKf7oeL1r5t6:l7qvw8t8tJOZVJnlYJL/ekLR7bZA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 376 wrote to memory of 1568	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 1568	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 1568	376	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlDTE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlDTE.dll,#1
2⤵
PID:1568