561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
310s
max time network
407s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Target

PROPAMAT/FlDTEImpresionPE.dll
Size

28KB
MD5

3e763883cc8aa0c7e469c2487bc84e3f
SHA1

c6bbe56e4681badb31b07707717c56919f8e1a93
SHA256

e0b8d911f8bcf54b99b3f2315a61c5a323eb9a8a132cc988235da864718578fb
SHA512

57b2f5ff934b4197ad2d19e41b3e425a0b66b0f4da07fbb2558588b6184562824fd5523fe22e00f4ad01a99e452014072648fbe2fe6b72e74a49da5f1499cc43
SSDEEP

192:L7mEXmIk6uN81g0Te5Q4HmC60Xn1ZVCnlYJL/ePkX9F5RKMzXdXjUqSBM:LismbTh08XnnxqPG9F5RKMzX8M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4540 wrote to memory of 240	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 240	4540	rundll32.exe	rundll32.exe
PID 4540 wrote to memory of 240	4540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlDTEImpresionPE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlDTEImpresionPE.dll,#1
2⤵
PID:240