561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
276s
max time network
623s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Target

PROPAMAT/FlDTEServices.dll
Size

1.0MB
MD5

09373cbda85578de6f4b7109dbff95fd
SHA1

e3c69f0babcecb0c53723fc119e0e2d07e9f4d5e
SHA256

5865a1654422b6bcf21c2897c57c3e9c028113c24578a347d3184e8627659e45
SHA512

566851398a796fb41e48c6282e4adb53b6594f59f82f29c877f1476196d0f64aeed28966c5e2f98c10262f5c56b718c20c73af5b71a0325d626920ad2cd1a713
SSDEEP

12288:UWxePkg38ukJx/PLvL4LbLCLlLtL/LlL7LlLbLLLpLgLBLVLlLxLOLyLBLdLVWmf:QRSiIeEZU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3816 wrote to memory of 1716	3816	rundll32.exe	rundll32.exe
PID 3816 wrote to memory of 1716	3816	rundll32.exe	rundll32.exe
PID 3816 wrote to memory of 1716	3816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlDTEServices.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlDTEServices.dll,#1
2⤵
PID:1716