7bbb458e6579df29118174eb65579f6f02773e8ead9e89b65933191796774617

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 16:07

Target

libnpth-0.dll
Size

27KB
MD5

e132eccf9a1eac741c9e9806a143c475
SHA1

e5420ea0a935e32a6b4634756345aa3d2174cac5
SHA256

30362bd4c6d7d2bf23f76b2d23a64dfdb79f3dd3f32478e6247d31cf1de78fc7
SHA512

3ea415452dd3ee9d0571c3ecad32cac2f24895cfaf8756bb3543a9e193deb46edee8fd73c38b188b44dd296fabe7013d74dfd4ca02e3a4485f339e6c49a1ff05
SSDEEP

384:S4Io6T8B6ShjRWuU4JfSZ1kUMqurUfc1ckt+w0WhGGdBAVXIZTmGiWmrzsgWlsAb:FRxYkUJE0WdBAVXIriDrzw/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2796 wrote to memory of 4628	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 4628	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 4628	2796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libnpth-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libnpth-0.dll,#1
2⤵
PID:4628