e0fed2784ab6280f6f602be319b4d4d4884778e4bfd1e88e6948a751b8523f60

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2023 07:36

Target

Setup_new/libwinpthread-1.dll
Size

77KB
MD5

1f4411c1f66c9cdf96ca9d7f9caf52d9
SHA1

ea04be653df7335483c7c8f46367d75d4ad9224e
SHA256

b5fe4d6408ef2baabdd168f4c7250900606468e9aeb24c71e0c833d3d715ae65
SHA512

8b95d0533773c5424733862cf60ed0f0d2ed5c7016b602a71dc4ce4a90ef0946de605f46c94fb0f6c3135447f60a00d3476e8b91a61e079885aa764bc1407b8a
SSDEEP

1536:NCogndcxz8C7iYx3AUwTG36Djm2uYUjslAsvONDuJluLjIGxim3Yx:Nydcaix3v363K+GNDDLjIEim3Yx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3132 wrote to memory of 1480	3132	rundll32.exe	86
PID 3132 wrote to memory of 1480	3132	rundll32.exe	86
PID 3132 wrote to memory of 1480	3132	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Setup_new\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Setup_new\libwinpthread-1.dll,#1
  2⤵
  PID:1480