561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2

Analysis

max time kernel
310s
max time network
400s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Target

PROPAMAT/E_Net.dll
Size

31KB
MD5

8d74473ad2e18257030d94578a250168
SHA1

cc0a42d4206d68b12f14c53426cca5fb5b29c51d
SHA256

83097db84eb523f4bda68c08f9b02c99d84e0ee42bae7fc4e9a5701b2aeff4af
SHA512

5f4e1e994981ffce7f040568522cf3fb5cb373a58e15265806a5958fda4e4c3d1ad29f60875713f08f7a7d8fb1eb977c0c39e45f97e424cc38bd7373e623f1ec
SSDEEP

384:zGS6OWBYVtZvTVOFBu5WLHHJw8BZhNSlpOnXWge4KQ4GEVhfVqp1NGnaH4paca7Q:DwY5mNLHHJwsnNbXWQEVHaH4UZ7kYHG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4660 wrote to memory of 4532	4660	rundll32.exe	rundll32.exe
PID 4660 wrote to memory of 4532	4660	rundll32.exe	rundll32.exe
PID 4660 wrote to memory of 4532	4660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\E_Net.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\E_Net.dll,#1
2⤵
PID:4532