18fb1efac7a965e3be1b7c090324e291fcdaba65ec213619d245aa4aa54387ba

Analysis

max time kernel
125s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 14:05

Target

api-ms-win-core-datetime-l1-1-0.dll
Size

17KB
MD5

8894176af3ea65a09ae5cf4c0e6ff50f
SHA1

46858ea9029d7fc57318d27ca14e011327502910
SHA256

c64b7c6400e9bacc1a4f1baed6374bfbce9a3f8cf20c2d03f81ef18262f89c60
SHA512

64b31f9b180c2e4e692643d0ccd08c3499cae87211da6b2b737f67b5719f018ebcacc2476d487a0aeb91fea1666e6dbbf4ca7b08bb4ab5a031655bf9e02cea9a
SSDEEP

192:fW1hWiH+49Cjdks/nGfe4pBjSY285a+W5RKTt3E2sVWQ4GW2TwE9qnajuZDAJaaj:fW1hWZ4wm0GftpBj8m3SLwwlUKTf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2812	1184	rundll32.exe	83
PID 1184 wrote to memory of 2812	1184	rundll32.exe	83
PID 1184 wrote to memory of 2812	1184	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-datetime-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-datetime-l1-1-0.dll,#1
  2⤵
  PID:2812