ba067698a42552e1f975d0c5c57ba51623c4db634ba7830a7a90bc4a219a48eb

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 19:14

Target

Debug/api-ms-win-crt-string-l1-1-0.dll
Size

23KB
MD5

ad99c2362f64cde7756b16f9a016a60f
SHA1

07c9a78ee658bfa81db61dab039cffc9145cc6cb
SHA256

73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa
SHA512

9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7
SSDEEP

384:jiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWS4wm0GftpBjwwO5m3S9lJrm:j6S5yguNvZ5VQgx3SbwA71IkFhbFViWs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1520 wrote to memory of 2500	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2500	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2500	1520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\api-ms-win-crt-string-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\api-ms-win-crt-string-l1-1-0.dll,#1
  2⤵
  PID:2500