a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 00:17

Target

System.ComponentModel.Primitives.dll
Size

74KB
MD5

c62050b023a65b14db3adffb1593e732
SHA1

97a03772321ef4ace3645221a26974c3ec0f0cb9
SHA256

8e80a728bef6ae7a72166ece5b989baff0a6011423f5fb707460518365a0ee0d
SHA512

340062eb9d90bafcd20e9d7d6f504b7b56a5507e6a87322c5f783e6ca5983490b4c5b64687453b8b48681b30b1009f6c1488ae83be72e1ec1b592e5b907896cf
SSDEEP

1536:Ydu/dSa4Y4Y4Y4Y4Y4Y4Y4Y4Y5K63nQvOul/XxBuHg501M9F2okQPRKeV3iAVz6:Ydu/dSfqwF2oJP7VJe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4872	1860	rundll32.exe	90
PID 1860 wrote to memory of 4872	1860	rundll32.exe	90
PID 1860 wrote to memory of 4872	1860	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.Primitives.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.Primitives.dll,#1
  2⤵
  PID:4872