a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 00:17

Target

System.ComponentModel.TypeConverter.dll
Size

678KB
MD5

dbcfec0b3492f984ceadfca8e4da5783
SHA1

168dea2ffc790af48ddeee04ac70e4eef77df4bc
SHA256

1a99fcafca0e578570214af2fdc0f4770c3fcd556a371084d86243714b52e7fe
SHA512

d5fcb4644e0cf626b537b246c131556d6f292b1d7765765a2e48470ced26192296e003339f7ff6bdf23c9e4d538a4cb125dd1c3f638d7851a9fe16439b7ce35e
SSDEEP

12288:wEYO+ueO+ueO+ueOrBg3uNAHjiQAQBsB4lLbXE6djnytrXlnmlsvgdjUnBXkLulv:wJO+ueO+ueO+ueOHXQBfF9djnytrVnmq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3216	4328	rundll32.exe	89
PID 4328 wrote to memory of 3216	4328	rundll32.exe	89
PID 4328 wrote to memory of 3216	4328	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.TypeConverter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.TypeConverter.dll,#1
  2⤵
  PID:3216