8cff2c0b64520d1dafd196f0ed84d5a32a3e10adf160fb11efe32129c5f27102

Analysis

max time kernel
42s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2023 19:34

Target

DotNetAobScanMemory.dll
Size

13KB
MD5

0f18d4f8323041b82363d2f4ec020957
SHA1

bc77e35fa2b2af0669e9336543412d62798b64fc
SHA256

2da7c186708ff1fcf363a35a8d776e0cd3ffe4efe07f203d1a874d1ec4df8bea
SHA512

12a5b22722a8ae8db5c91a3b5ef54d708cd8f67f7a75940fd9a9376e573a1675915fcb94cdb6249cdacc027f2a3c376a559e922fe6c0c6649c55dd1cf4e87889
SSDEEP

192:GIPj9gBEoRbDzWu62MD4Bm2khzfTpZaBz8RjKPnueyF2Yywhdz+:Gk4b/WuuRzfTpZYz6MueyF2YThdz+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3368	2092	rundll32.exe	84
PID 2092 wrote to memory of 3368	2092	rundll32.exe	84
PID 2092 wrote to memory of 3368	2092	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DotNetAobScanMemory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DotNetAobScanMemory.dll,#1
  2⤵
  PID:3368