e0104b1c647808aa4c35d8486e4b88a10e3f5565fdbf71411e7477f579f5aec2

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:10

Target
System.Net.Http.dll
Size 1.3MB
Sample240526-pb2hgsbb2v
SHA256 e0104b1c647808aa4c35d8486e4b88a10e3f5565fdbf71411e7477f579f5aec2
MD5 f99c2dcbcf3d49fcaa1154d23cf6057b
SHA1 6460a454c12a22e3815d45c395d8aa31092213c7
SHA512 f8c1e1bbb8ce67ac0872065f57f19a1002ab38a51a6580eefcec379aa51d4ac1c6d3afbc0397fc2a17cd940e4255532028ca7e08816db5eaa0353b6f5cc226a9
SSDEEP 24576:Bk34Xk6GYiceH3iClcfBcwHoOHKIL879ZzAIXW7I:Bk3Wk6GZlcfRIjcIYI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2424	4684	rundll32.exe	82
PID 4684 wrote to memory of 2424	4684	rundll32.exe	82
PID 4684 wrote to memory of 2424	4684	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Net.Http.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Net.Http.dll,#1
  2⤵
  PID:2424