2460d8af2932c21a50b086960c390308aad351ac48b0262d782f1dda3a564b9a

Analysis

max time kernel
156s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 03:51

Target

mscorsvc.dll
Size

245KB
MD5

f9ada64129e00d8819314cdb9853a4b4
SHA1

600d9dcb267f0a2c5b9a3a591ca280df0b91cffd
SHA256

2460d8af2932c21a50b086960c390308aad351ac48b0262d782f1dda3a564b9a
SHA512

601b8363c480f095e068eb7f66f98b266bc05bfb61df1a96ecf0be9bfc828736bb231616b4f7ab45a180f0aed9fa586e93424e2da7fc417cca2580c4b893bcf3
SSDEEP

3072:xjqmRIgCmJVf9KApDJiqVP5fPKw08ToYHChlm2SQOiGkgN5+W+GjnoM:xjZ2gCmJdMAps6nKw080Yihl/PrKT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 5064	5020	rundll32.exe	86
PID 5020 wrote to memory of 5064	5020	rundll32.exe	86
PID 5020 wrote to memory of 5064	5020	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mscorsvc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mscorsvc.dll,#1
  2⤵
  PID:5064

memory/5064-0-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-1-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-2-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-3-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-4-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-5-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-6-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-7-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-8-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-9-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-10-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-11-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-12-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download
memory/5064-13-0x0000000074EF0000-0x0000000074F39000-memory.dmp

Filesize
292KB

Download