70e9486b50278e7a54f5117ef8d3b7dce2b2701b51e38b6ef2466d88eef23b77

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 12:09

Target

api-ms-win-core-threadpool-l1-1-0.dll
Size

4KB
MD5

68ba9f82e005acc75392451302751a1e
SHA1

893b69b4a6d43a6bc5f27d7232840bfff6538b85
SHA256

70e9486b50278e7a54f5117ef8d3b7dce2b2701b51e38b6ef2466d88eef23b77
SHA512

a9ae870582287c7afd14c739f9d430029d53e26d407fc28d1e0a92c831b0b44a6a0ff99dda09506d9bdfe4e38b5a2955d9318ea5aa7c5ffe9293ae26cf709fda
SSDEEP

48:qjmnvUPmaAOUhDJF98uWMKqtVIZWUKc06Yh/5WwaE0:n8zAOyDJF98uWMKkEWc06KhWwn0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28
PID 2236 wrote to memory of 1968	2236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-threadpool-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-threadpool-l1-1-0.dll,#1
  2⤵
  PID:1968