561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
311s
max time network
396s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Target

PROPAMAT/FlFramework.FlExceptionManagement.dll
Size

41KB
MD5

20ec2c4a66f0fe7f3ee5b8360679e6e4
SHA1

c5388254eb8c71fa1b442422eb35ba0d05a19bc4
SHA256

d325349f9f0e077c4de6ad96f903009876e4e1b222e19993e761808149e4939a
SHA512

2c2e6c63533cbaab3d40e1eb70f105a1a98fed077f7165576c47cfd874aba161e8c42fa95fc017af8074c6ef4fba2608a16c1d7c6ac494b5fa23ae7852fe51f9
SSDEEP

768:qaJQNBFa5BvkWdlEYVsZ3jBCQ5dOVJRiLwbjDQ6/JN:qRBc5Bv7dfsZ3jBld58d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3928 wrote to memory of 4676	3928	rundll32.exe	rundll32.exe
PID 3928 wrote to memory of 4676	3928	rundll32.exe	rundll32.exe
PID 3928 wrote to memory of 4676	3928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlFramework.FlExceptionManagement.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlFramework.FlExceptionManagement.dll,#1
2⤵
PID:4676