a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae

Analysis

max time kernel
123s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 00:17

Target

System.ComponentModel.TypeConverter.dll
Size

678KB
MD5

dbcfec0b3492f984ceadfca8e4da5783
SHA1

168dea2ffc790af48ddeee04ac70e4eef77df4bc
SHA256

1a99fcafca0e578570214af2fdc0f4770c3fcd556a371084d86243714b52e7fe
SHA512

d5fcb4644e0cf626b537b246c131556d6f292b1d7765765a2e48470ced26192296e003339f7ff6bdf23c9e4d538a4cb125dd1c3f638d7851a9fe16439b7ce35e
SSDEEP

12288:wEYO+ueO+ueO+ueOrBg3uNAHjiQAQBsB4lLbXE6djnytrXlnmlsvgdjUnBXkLulv:wJO+ueO+ueO+ueOHXQBfF9djnytrVnmq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2192	2176	rundll32.exe	28
PID 2176 wrote to memory of 2192	2176	rundll32.exe	28
PID 2176 wrote to memory of 2192	2176	rundll32.exe	28
PID 2176 wrote to memory of 2192	2176	rundll32.exe	28
PID 2176 wrote to memory of 2192	2176	rundll32.exe	28
PID 2176 wrote to memory of 2192	2176	rundll32.exe	28
PID 2176 wrote to memory of 2192	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.TypeConverter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.TypeConverter.dll,#1
  2⤵
  PID:2192