5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
139s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13/01/2024, 04:57

Target
netstandard.dll
Size 72KB
Sample240113-fla9lscdgl
SHA256 de0ef6c3af1c9b8199ba4e16c1392d3127a4a30dcc4cfbf96bcc463fe0a5d27d
MD5 671ed9d6e873ad29ccff10bcfaea6021
SHA1 49507f0040c27249e209be9ff92ea4c143575873
SHA512 15649a0a37d1e26bf3e670ee1986a6f6d991a6821868f2e90c1a1986122c4cfa78854f5f02c7d5ec1354837126f3226da09f8c89823496045644b48fc4e80f6e
SSDEEP 768:y5x6TGSoxq/iImVvMVYd75IXL4bObKZbc6NtjSPU5gBkVb7TikFlnQrOu:AxFwiIU6Y15C4bObKZlNAs5fukFOf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4112	4240	rundll32.exe	80
PID 4240 wrote to memory of 4112	4240	rundll32.exe	80
PID 4240 wrote to memory of 4112	4240	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\netstandard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\netstandard.dll,#1
  2⤵
  PID:4112