163edff5aec2819e87bde2bbb4369bef309bc395aaf0e5610235152844967631

Analysis

max time kernel
375s
max time network
1589s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
28-02-2023 22:16

Target

MultiMC/libwinpthread-1.dll
Size

48KB
MD5

d128ae39a79e5d196fc001907b5ec3d1
SHA1

71de74d0aa93903e0a169c88fd21e0c617f0660a
SHA256

4195ac1e3a4a8056de42c31d511e0e595772439adba96180b8953ef5f135f7a5
SHA512

5b32eb7e2f01fb17ed0c4434a525ae3056acddde75c32c5036c18b6f2ffa4cf80cfee9bab4c824ca313e6e33114ea0e761dc8f75db3bbbbe4319c079848a3c06
SSDEEP

768:NdOT5wjxqOfH36THnf/GcTuI4bOBxZXmVwDI7dTBhkSoFrg22222222222A26wiB:rE5wtqOfX6T/uDIm4xZ2WI7jhkSoFHij

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1632 wrote to memory of 1672	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1672	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1672	1632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\libwinpthread-1.dll,#1
2⤵
PID:1672