d380b9d284b0f69caa6813b01993877327e47486aa93b0f989c26e786d35d05d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 05:34

Target

AppManagementConfiguration.dll
Size

112KB
MD5

7092e4cadee6b8972701d645998f4f74
SHA1

679cc746e4432ed223072d454fd4b1e525a363ce
SHA256

d380b9d284b0f69caa6813b01993877327e47486aa93b0f989c26e786d35d05d
SHA512

8d98a8b957a164e7f5cdff4b28165cded020a7b23f5b4251e421cfec391c5e4ecd7ed5bf5849e7c0a6e0130e312215bd5b7b1bf9bd5c5328eb9ce50840bdddb6
SSDEEP

3072:ZnITbnIIesnx4EI6ws/IycvkQa+EhYMj4wR8SCQNHEJqg/Qa3jUR3XbJw:TcT3LCQLY3zURnb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4356	5080	rundll32.exe	82
PID 5080 wrote to memory of 4356	5080	rundll32.exe	82
PID 5080 wrote to memory of 4356	5080	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppManagementConfiguration.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppManagementConfiguration.dll,#1
  2⤵
  PID:4356