26e58ffdc62eb3c0d5fe91aa4db7c4fae6e6cf3e7c6a5756977c2807f1815fcf

Analysis

max time kernel
129s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:23

Target

MapControlCore.dll
Size

698KB
MD5

5b1dab6fc3627a51b839c7f71c4959d7
SHA1

89d0bb87b8dc7040e4dd3272e781c1b041d68d88
SHA256

26e58ffdc62eb3c0d5fe91aa4db7c4fae6e6cf3e7c6a5756977c2807f1815fcf
SHA512

2442342d7b858bffae8c2509c22b80aca6c38d23e64d001194bcf0410f037c40a30627d4388e5f2e913da6f9636abf9180a56ff7ee691b56996dda7cf4951db8
SSDEEP

12288:RIlJZf1T9dEr+JEzksLAHnuA4C6LitUI8u2H6scdKWvZIGVD33StFgnc40vQKWqF:GlJZf1T9dEr+JEzksLAHnuRC6Li0x+QL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 1136	3728	rundll32.exe	82
PID 3728 wrote to memory of 1136	3728	rundll32.exe	82
PID 3728 wrote to memory of 1136	3728	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MapControlCore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MapControlCore.dll,#1
  2⤵
  PID:1136