1027d3cde9ef849479606e266c8b87add68a07cc7d0aeb8081a9654b5cab457a

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2023 00:07

Target

msi_misc.dll
Size

2.4MB
MD5

8bcf7380a39ddf723b5e5683c7fdb650
SHA1

aa7615722fce9103a8c7ed276bcbcc83c6e04d42
SHA256

0512f9ab55d9999745f4ea8567b9dc4b5e4c8e75e159e632c8a55d5a7511c57b
SHA512

2ee1507366a3692a38e669841b60f2ccc69c2f2d706ac33d29b34edec40624adea25c522dd94b5344649de270a2a4f58999754a6b613dd51c70cd60e9108de37
SSDEEP

49152:NaAsO3pYFRose9HuBWXYen0qCSI6++5+bZj+i7LW4rjQQHPJuiwIn5OatGQWfGaH:NaAsCpYLosgHpXjnhCSIRfHrjQkPIU5g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 5068	1608	rundll32.exe	85
PID 1608 wrote to memory of 5068	1608	rundll32.exe	85
PID 1608 wrote to memory of 5068	1608	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msi_misc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\msi_misc.dll,#1
  2⤵
  PID:5068