c29345010ff6aa0f7baa68cb94acee064750c69c995d7502652ab9a196a52089

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 11:58

Target

TextInputFramework.dll
Size

529KB
MD5

d2ea25068a1d111deacf938fbf4e4281
SHA1

7d5a228769f29c8656f937f93a73133a4d594eae
SHA256

c29345010ff6aa0f7baa68cb94acee064750c69c995d7502652ab9a196a52089
SHA512

3ad9d75cd19dcae25d6e0ff434e81c94eeed7ae0f33bf59c481d1a1f5443dc471fba04b290159c1004cfe4d16c6d6206dd2788f29d11930716009e7d487f1d1d
SSDEEP

12288:7TX64BRbqyNw5/PMtHdlmLncfLGCe1W0+IYx4X73fPmh6EVOT2yLb5v/JrnPI/:/KEc4y/PEaLncfLEJdYOXbfPmh6EVOT+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 3616	972	rundll32.exe	82
PID 972 wrote to memory of 3616	972	rundll32.exe	82
PID 972 wrote to memory of 3616	972	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TextInputFramework.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TextInputFramework.dll,#1
  2⤵
  PID:3616