1e021194109e9289366218767a16345981d30daa807a53b5d9842179eceb3d13

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:37

Target

LicenseManager.dll
Size

830KB
MD5

033aa9e67c1955e03b12b8eee95170db
SHA1

07cf23eeba9a0420266d7e5884fdd98a403227e0
SHA256

1e021194109e9289366218767a16345981d30daa807a53b5d9842179eceb3d13
SHA512

16d081ef69a792d9ca866f80b912ab88fa0ece386dc40bb6ff2e9e498953e8885ffca561da0ae3613ded65716f43669e6be718869168062abfabe2bb756c335b
SSDEEP

12288:9uKfHkxwnbZ797zF/qHGYRaLI+XDIp2r9G9z1YBWRBJb+pP:9uK3bZ79d/qHGYRaVG2s9z1YARBJb+pP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4788	3576	rundll32.exe	83
PID 3576 wrote to memory of 4788	3576	rundll32.exe	83
PID 3576 wrote to memory of 4788	3576	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LicenseManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LicenseManager.dll,#1
  2⤵
  PID:4788