a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae

Analysis

max time kernel
141s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 00:17

Target

System.ComponentModel.Annotations.dll
Size

178KB
MD5

8cb920ac00ceec5f94100cee6daa4cff
SHA1

c3cd821941a0503c1ee4e1d927f2dec15c3e8b8f
SHA256

edbc43facc304e5ef0942ab36edaff9983ebb17356c3e1fb8ab0309c3900f6f8
SHA512

b0b8cc6903b4327ddd1d4a4f25fd36982ec8e59cb248457e5516a104979927ee86f3b8f51cfbf28a76e028cbcb0bcd3486b9ad04c80650d1e76ae3e940ad987f
SSDEEP

3072:Mm7cH9oS7SLQnnd4Gb6mRhx5D5/vbF6IF1yEDMUPxRL7GmMV:/4oSgQnd4GWUhx5t1y8MUPxRX4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4632	3664	rundll32.exe	88
PID 3664 wrote to memory of 4632	3664	rundll32.exe	88
PID 3664 wrote to memory of 4632	3664	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.Annotations.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.Annotations.dll,#1
  2⤵
  PID:4632