961bf55f25103eeb23ae7f6d25ea26f57eb23ebd521ef5c7397f50aeac37ac8d

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 20:04

Target

SearchComponent.dll
Size

212KB
MD5

19a3c58c3d4161f67d63ab1aa32d89e2
SHA1

46fc810f1dcfe26826a87d347cb4606b35cc675b
SHA256

fc24d4248c49606f760ed871512bda7d09ba1a1d242347e33a60ebf8b8d72192
SHA512

70f36bdf420ec3697777062aacaf5805de9de7ed4b03d4032512690ded305c0c3f3cdde63bafdf3f3d6a0b2ab9b0f1b9ad0c934deea2fb50d1a49a254792528f
SSDEEP

3072:A5Y6PErq0i4qtw0WjVhuqHzYwU+qDLvYJL1CfImwUXl/5CMXaPPVR:MPPE6tw0W9TfWDLvYJLwILmQMKPb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4052	3740	rundll32.exe	86
PID 3740 wrote to memory of 4052	3740	rundll32.exe	86
PID 3740 wrote to memory of 4052	3740	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SearchComponent.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SearchComponent.dll,#1
  2⤵
  PID:4052