5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
139s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13/01/2024, 04:57 UTC

Target

netstandard.dll
Size

72KB
MD5

671ed9d6e873ad29ccff10bcfaea6021
SHA1

49507f0040c27249e209be9ff92ea4c143575873
SHA256

de0ef6c3af1c9b8199ba4e16c1392d3127a4a30dcc4cfbf96bcc463fe0a5d27d
SHA512

15649a0a37d1e26bf3e670ee1986a6f6d991a6821868f2e90c1a1986122c4cfa78854f5f02c7d5ec1354837126f3226da09f8c89823496045644b48fc4e80f6e
SSDEEP

768:y5x6TGSoxq/iImVvMVYd75IXL4bObKZbc6NtjSPU5gBkVb7TikFlnQrOu:AxFwiIU6Y15C4bObKZlNAs5fukFOf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4112	4240	rundll32.exe	80
PID 4240 wrote to memory of 4112	4240	rundll32.exe	80
PID 4240 wrote to memory of 4112	4240	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\netstandard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\netstandard.dll,#1
  2⤵
  PID:4112