f4d72516e3e60d2cd3a103c227be0dd923578e932bec9121b6d134d96b4d0984

Analysis

max time kernel
97s
max time network
255s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:11

Target

Programs/Imager/boost_system-vc90-mt-1_39.dll
Size

12KB
MD5

1ad8ef7baba7dd862cd5d13df6c2677b
SHA1

81ad6243177553019ebad0eed09f44a329c45cf4
SHA256

1f1fdec25884181785bc8f457f3096a107cace9bc55b3051d7ed8a2ac7647a4c
SHA512

efe5bf8e0a88d7f4d42c66f565946cb866cc40ad7135b1b26425767ecb52bdbb46f063b3a036a888364913e6a31882effaa7bb2227029f24eb1e66ad4232e944
SSDEEP

192:0VKoJ2JJ1k8PilpaOxxTrj/6LgQdNVfzEK0ZaOu3XyEqxSpevdT:0ku271P8agTrj/IB+aOyihSAVT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 5056	4008	rundll32.exe	85
PID 4008 wrote to memory of 5056	4008	rundll32.exe	85
PID 4008 wrote to memory of 5056	4008	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\boost_system-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\boost_system-vc90-mt-1_39.dll,#1
  2⤵
  PID:5056