a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 00:17

Target

System.Collections.Specialized.dll
Size

94KB
MD5

e5b8fb1667440057ec69b7c4dfb14d50
SHA1

706e2ca37573dae86f29bc63fd85d18f59b0abe7
SHA256

bd0c8b5ab4ba787b78afe9519a195e686449b7016d9ec7524b9292d6dcc045fb
SHA512

56fe916d24ffbffcf96ff23a2469e7dfb98abd108e1607e546e207066e00d47436718885345c01bbc0084c4a657c9020882767ca3aac129d108957c5002412d2
SSDEEP

1536:Xg/qY3neX5D09UwBRj3sAR4tTX5qZfbrm5ghUxtwkmAPgi0+zl:Xg/qge29Uw13sAR4JXwZG5ghUHwkmAPD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2232	3032	rundll32.exe	28
PID 3032 wrote to memory of 2232	3032	rundll32.exe	28
PID 3032 wrote to memory of 2232	3032	rundll32.exe	28
PID 3032 wrote to memory of 2232	3032	rundll32.exe	28
PID 3032 wrote to memory of 2232	3032	rundll32.exe	28
PID 3032 wrote to memory of 2232	3032	rundll32.exe	28
PID 3032 wrote to memory of 2232	3032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Collections.Specialized.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Collections.Specialized.dll,#1
  2⤵
  PID:2232