0863df068036557a08a6788038b407614ee672001f10cd79f51d49ac0dd65c94

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:07

Target

Microsoft.Management.Infrastructure.Native.Unmanaged.dll
Size

14KB
MD5

be2ecac7a2e4f96af7903de62807a663
SHA1

d0516d6e6293124c6863288a50bc3d2fe1064c1c
SHA256

0863df068036557a08a6788038b407614ee672001f10cd79f51d49ac0dd65c94
SHA512

61b41164635e98f836457453ccab9afb79572c4af56d9e16682d08469c74c4c37387168e3709268912507553fbce29b541be340ed9b801adcb59c940561c6915
SSDEEP

192:c32EVePjORP9jGgWwnhkSveZTgEGGgE5g1Q6D+GWHCeWOf0:c7VePjePpGgWwnhkyedrHED+GWHCeW5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 3740	1160	rundll32.exe	82
PID 1160 wrote to memory of 3740	1160	rundll32.exe	82
PID 1160 wrote to memory of 3740	1160	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.Management.Infrastructure.Native.Unmanaged.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.Management.Infrastructure.Native.Unmanaged.dll,#1
  2⤵
  PID:3740