64ae1e92920768b17b0adef22b5a61bf82c83c5deb2ab6f24b3829bf25581d37

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 04:53

Target

Android/libwinpthread-1.dll
Size

205KB
MD5

147f26f198f9fb041972acedfba499f1
SHA1

15ecae45e1fb2acec53384f8071d2943cc895fd4
SHA256

ef1ca784aa18e9ab789d44e90cade99b21563a55daa0019f1e9cd1fb812edd27
SHA512

bbe9bee7d81cbe488124132f939de33273a2c00f6fcdce5d58a36c32e57aa0cf72f58a88e912329e73053c8295d9e49946770a3ac7a250e1546717d240971971
SSDEEP

3072:+aRM482B+CVWgRKB3daWBxhim3YdMgFelrzv6/f6EO7bMDOI4nweQhGnxtubRjLj:+avBxkxhim3Y+gIlXv6/8QhGxY2rd4LL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1512	2440	rundll32.exe	83
PID 2440 wrote to memory of 1512	2440	rundll32.exe	83
PID 2440 wrote to memory of 1512	2440	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Android\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Android\libwinpthread-1.dll,#1
  2⤵
  PID:1512