cddc7c774570b556d8d391203f8084e97850f3cee8a482a0c36ea74de348da2f

Analysis

max time kernel
127s
max time network
133s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
23-07-2023 22:52

Target

languages/en_XM/ManifestDedupEngineDotNet.dll
Size

78KB
MD5

89b8e7e62ead8271849310eea29d3e1c
SHA1

ec3d8a29712c000f5dea41a1713dbdf28bc7e2a1
SHA256

6075b892121ef2f8856082aa4b5cf508a78b835f846e1e86a412ed714e25210c
SHA512

59dcd2083b8e1c2c509e588354d3863bcafb4734b7f63dbb7bef687653cc849eebbfcc7b0f0dc508842caea274a928258a860bae53309fdf6e471d5c35dd69e5
SSDEEP

1536:QtshZyiimYQeBr4balrKK8zp+IUttyYRzkkXCzBaA4M:wAbi1/rKZV+vtHXCzv4M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2432	2332	rundll32.exe	70
PID 2332 wrote to memory of 2432	2332	rundll32.exe	70
PID 2332 wrote to memory of 2432	2332	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\languages\en_XM\ManifestDedupEngineDotNet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\languages\en_XM\ManifestDedupEngineDotNet.dll,#1
  2⤵
  PID:2432