2ef69f36d3a99e423ae6b8de52168fd26656d0c274845270000b013043daac7e

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2023 20:46

Target

MultiMC/libwinpthread-1.dll
Size

48KB
MD5

d128ae39a79e5d196fc001907b5ec3d1
SHA1

71de74d0aa93903e0a169c88fd21e0c617f0660a
SHA256

4195ac1e3a4a8056de42c31d511e0e595772439adba96180b8953ef5f135f7a5
SHA512

5b32eb7e2f01fb17ed0c4434a525ae3056acddde75c32c5036c18b6f2ffa4cf80cfee9bab4c824ca313e6e33114ea0e761dc8f75db3bbbbe4319c079848a3c06
SSDEEP

768:NdOT5wjxqOfH36THnf/GcTuI4bOBxZXmVwDI7dTBhkSoFrg22222222222A26wiB:rE5wtqOfX6T/uDIm4xZ2WI7jhkSoFHij

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3528 wrote to memory of 1036	3528	rundll32.exe	rundll32.exe
PID 3528 wrote to memory of 1036	3528	rundll32.exe	rundll32.exe
PID 3528 wrote to memory of 1036	3528	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\libwinpthread-1.dll,#1
  2⤵
  PID:1036