a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 00:17

Target
System.Data.Common.dll
Size 2.7MB
Sample240313-ald3lsfb51
SHA256 9064122f6ab10928fadc2e244287d0d9ca068e0b1b9a5ed65e2fb9f71ec5c47a
MD5 a5e6418794faf04ae4c9b7eb37e2fa52
SHA1 da08753e9e3de4ede668902a98b43a04345664c3
SHA512 1c23dea2ff770a597043658177fb3413733e244fe38bcfbe1b673fe9aa9a47c6b082fd3b82ddc52329b5b08e3f54435d37ff6c00516b32226d25ea36de702af9
SSDEEP 49152:iJbrz83SifrRXbuoYTw6Xr4Kdd/ebiBoHtk069gN4srA1:2rzn7sHg93sg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 2184	4872	rundll32.exe	90
PID 4872 wrote to memory of 2184	4872	rundll32.exe	90
PID 4872 wrote to memory of 2184	4872	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Data.Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Data.Common.dll,#1
  2⤵
  PID:2184