99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103

Analysis

max time kernel
136s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:44

Target

netstandard.dll
Size

72KB
MD5

671ed9d6e873ad29ccff10bcfaea6021
SHA1

49507f0040c27249e209be9ff92ea4c143575873
SHA256

de0ef6c3af1c9b8199ba4e16c1392d3127a4a30dcc4cfbf96bcc463fe0a5d27d
SHA512

15649a0a37d1e26bf3e670ee1986a6f6d991a6821868f2e90c1a1986122c4cfa78854f5f02c7d5ec1354837126f3226da09f8c89823496045644b48fc4e80f6e
SSDEEP

768:y5x6TGSoxq/iImVvMVYd75IXL4bObKZbc6NtjSPU5gBkVb7TikFlnQrOu:AxFwiIU6Y15C4bObKZlNAs5fukFOf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 6132	5944	rundll32.exe	14
PID 5944 wrote to memory of 6132	5944	rundll32.exe	14
PID 5944 wrote to memory of 6132	5944	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\netstandard.dll,#1
1⤵
PID:6132

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\netstandard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5944