96a447bf9e4eacd5c7a17ea9fd091560e6e990daf82abb302be0aacefcb9ddaa

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:41

Target

System.ComponentModel.Primitives.dll
Size

47KB
MD5

c0ce7e6004b96015e8f16fe3564fcdd8
SHA1

3413b3bd5d29966997b2b8e1136ddd1e906ee6b2
SHA256

96a447bf9e4eacd5c7a17ea9fd091560e6e990daf82abb302be0aacefcb9ddaa
SHA512

a2e5ba7232444d08ad35e2b5d2c4946d1bc68143348c4818497c922760875587cafbdd921bf01ae6f8be0615eef6214ff60bc95cb1427d6340dafe5d2fa3448f
SSDEEP

768:P+5Bw2RmjnW3g3UcRSpQDDwkI84QwYQEocA90VU+N9Z3dujkYgFFXU:P+abKg3reQHwkI84QwYQEocAmHjYgDE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4876	4592	rundll32.exe	82
PID 4592 wrote to memory of 4876	4592	rundll32.exe	82
PID 4592 wrote to memory of 4876	4592	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.Primitives.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.Primitives.dll,#1
  2⤵
  PID:4876