ba067698a42552e1f975d0c5c57ba51623c4db634ba7830a7a90bc4a219a48eb

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 19:14

Target

Debug/api-ms-win-crt-environment-l1-1-0.dll
Size

18KB
MD5

39325e5f023eb564c87d30f7e06dff23
SHA1

03dd79a7fbe3de1a29359b94ba2d554776bdd3fe
SHA256

56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a
SHA512

087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085
SSDEEP

192:4rW1hWiSu7jCjdks/nGfe4pBjSYC69poCxW5RKTt3E2sVWQ4GWmEsSC9qnajuZDW:AW1hW6am0GftpBjtBQm3SzSKlUKTT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3940 wrote to memory of 4652	3940	rundll32.exe	rundll32.exe
PID 3940 wrote to memory of 4652	3940	rundll32.exe	rundll32.exe
PID 3940 wrote to memory of 4652	3940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\api-ms-win-crt-environment-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\api-ms-win-crt-environment-l1-1-0.dll,#1
  2⤵
  PID:4652