02bed981dce70b947d72c304a3f2e1cbdee963c315779d5717769f88c8166447

Analysis

max time kernel
127s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2023 11:53

Target

libwinpthread-1.dll
Size

77KB
MD5

1f4411c1f66c9cdf96ca9d7f9caf52d9
SHA1

ea04be653df7335483c7c8f46367d75d4ad9224e
SHA256

b5fe4d6408ef2baabdd168f4c7250900606468e9aeb24c71e0c833d3d715ae65
SHA512

8b95d0533773c5424733862cf60ed0f0d2ed5c7016b602a71dc4ce4a90ef0946de605f46c94fb0f6c3135447f60a00d3476e8b91a61e079885aa764bc1407b8a
SSDEEP

1536:NCogndcxz8C7iYx3AUwTG36Djm2uYUjslAsvONDuJluLjIGxim3Yx:Nydcaix3v363K+GNDDLjIEim3Yx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 5084 wrote to memory of 4628	5084	rundll32.exe	82
PID 5084 wrote to memory of 4628	5084	rundll32.exe	82
PID 5084 wrote to memory of 4628	5084	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll,#1
  2⤵
  PID:4628