6941f4998c8d31028e70cf62c5052999b1a15ee2d615f4eee31173d68cfa60b3

Analysis

max time kernel
130s
max time network
152s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 14:47

Target

TurboActivate.dll
Size

654KB
MD5

38884fa73e0b948c2dfffd83a67f263c
SHA1

0a40647b4f7b586c0ecac0e89f94baccb9388f0d
SHA256

ed0684eb523065884ffa3ce8f6690fbdd6792d423061cc099bcee3bdb17b8af4
SHA512

80a4632a1ae540ff29f2106cceff0fe2f14d56828544a758513c7a7c3574a73ac23046e0fc475eed2a8aa50417fe79d65ed5b3db96b3f43168a788da4a0adb3c
SSDEEP

12288:Ukqq4yOSV+OeO+OeNhBBhhBB3+43twbG9usDQQxTP6F59xcznfSafoYx:Ukq5yOSE+43tt9XQQxrq9On1foYx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4728 wrote to memory of 2360	4728	rundll32.exe	rundll32.exe
PID 4728 wrote to memory of 2360	4728	rundll32.exe	rundll32.exe
PID 4728 wrote to memory of 2360	4728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TurboActivate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TurboActivate.dll,#1
2⤵
PID:2360