23a66b32dfa75a94036870a1dce0bfabe6b52331eb2bed02e6953b9fead97298

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 21:13

Target

System.ComponentModel.TypeConverter.dll
Size

678KB
MD5

dbcfec0b3492f984ceadfca8e4da5783
SHA1

168dea2ffc790af48ddeee04ac70e4eef77df4bc
SHA256

1a99fcafca0e578570214af2fdc0f4770c3fcd556a371084d86243714b52e7fe
SHA512

d5fcb4644e0cf626b537b246c131556d6f292b1d7765765a2e48470ced26192296e003339f7ff6bdf23c9e4d538a4cb125dd1c3f638d7851a9fe16439b7ce35e
SSDEEP

12288:wEYO+ueO+ueO+ueOrBg3uNAHjiQAQBsB4lLbXE6djnytrXlnmlsvgdjUnBXkLulv:wJO+ueO+ueO+ueOHXQBfF9djnytrVnmq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3152 wrote to memory of 4064	3152	rundll32.exe	85
PID 3152 wrote to memory of 4064	3152	rundll32.exe	85
PID 3152 wrote to memory of 4064	3152	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.TypeConverter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.TypeConverter.dll,#1
  2⤵
  PID:4064