ba067698a42552e1f975d0c5c57ba51623c4db634ba7830a7a90bc4a219a48eb

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 19:14

Target

Debug/api-ms-win-crt-locale-l1-1-0.dll
Size

18KB
MD5

034379bcea45eb99db8cdfeacbc5e281
SHA1

bbf93d82e7e306e827efeb9612e8eab2b760e2b7
SHA256

8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65
SHA512

7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256
SSDEEP

192:lW1hWi6+49Cjdks/nGfe4pBjSY38yMsW5RKTt3E2sVWQ4GWbGBfqnajE49dRX3tK:lW1hWa4wm0GftpBjlWm3S7dlPptZA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2516 wrote to memory of 3772	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 3772	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 3772	2516	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\api-ms-win-crt-locale-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\api-ms-win-crt-locale-l1-1-0.dll,#1
  2⤵
  PID:3772