70e9486b50278e7a54f5117ef8d3b7dce2b2701b51e38b6ef2466d88eef23b77

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 12:09

Target

api-ms-win-core-threadpool-l1-1-0.dll
Size

4KB
MD5

68ba9f82e005acc75392451302751a1e
SHA1

893b69b4a6d43a6bc5f27d7232840bfff6538b85
SHA256

70e9486b50278e7a54f5117ef8d3b7dce2b2701b51e38b6ef2466d88eef23b77
SHA512

a9ae870582287c7afd14c739f9d430029d53e26d407fc28d1e0a92c831b0b44a6a0ff99dda09506d9bdfe4e38b5a2955d9318ea5aa7c5ffe9293ae26cf709fda
SSDEEP

48:qjmnvUPmaAOUhDJF98uWMKqtVIZWUKc06Yh/5WwaE0:n8zAOyDJF98uWMKkEWc06KhWwn0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4160	4800	rundll32.exe	83
PID 4800 wrote to memory of 4160	4800	rundll32.exe	83
PID 4800 wrote to memory of 4160	4800	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-threadpool-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-threadpool-l1-1-0.dll,#1
  2⤵
  PID:4160