f8ff5a4bc430485289886e16484bbb51afd7f1b9c10bc5f3f98b59cde86eb1cf

Analysis

max time kernel
82s
max time network
421s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:01

Target

debug/pthreadVC2.dll
Size

84KB
MD5

5eeba1afeb9a050acb0ef64a4ec6c736
SHA1

0a61a3bd52f885068494389f4d2323a4429e840f
SHA256

20230a540850e454b4cd0dd11b34d66d6826de1f839a5ac72b96bd32f76cccc3
SHA512

94cd37109afa3965335e4702a7c911c75173212f1dc52a0e2e0eb49a08dd63f9252eebcbd1342b6d47161a1cd83f6031deb549c24d75f7abdcbb35891ddd5abd
SSDEEP

768:9AsPjP7ma/rlQDiqckcwm3036wucj2YCuSBhaBEQtf4BAyflBiH3YbcZsyApi:9teUdqjuci5BOdV2AyNBiH3YbcZszpi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4852	4732	rundll32.exe	87
PID 4732 wrote to memory of 4852	4732	rundll32.exe	87
PID 4732 wrote to memory of 4852	4732	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\debug\pthreadVC2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\debug\pthreadVC2.dll,#1
  2⤵
  PID:4852