4627edd3379b1c61e0465501b2fae36b3ef7cbd7587cce2554c44f2850aeb856

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 11:58

Target

CortanaMapiHelper.dll
Size

188KB
MD5

f490fc70b42989f7f1ea016fabb806a8
SHA1

bc82923902b66ba489a4d98b75b6952222758f60
SHA256

4627edd3379b1c61e0465501b2fae36b3ef7cbd7587cce2554c44f2850aeb856
SHA512

10efe224d9211dca26fc472d25d10f774ade4bf278968d570f2dbc23794ca6741b8f20507c5ad8ddaecf6e2b9294f906696001e53d149f8aaac8c1a68a3c949d
SSDEEP

3072:1hQ5JrCBtiVZZ1ZiNfoBK3vmsRCkn1XKQ/zxaj9el/cF/eZahdYhT5DvguSgZPgT:1e5JPshf+s0kE9eJcJ8arYx6yPg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3792	3972	rundll32.exe	85
PID 3972 wrote to memory of 3792	3972	rundll32.exe	85
PID 3972 wrote to memory of 3792	3972	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CortanaMapiHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CortanaMapiHelper.dll,#1
  2⤵
  PID:3792