6dc3e8f3e9d416228fc641e19080298813d2a8fcd2840e6b13282f754b79f5da

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:23

Target
ICSharpCode.SharpZipLib.dll
Size 196KB
Sample240528-appnhsgf72
SHA256 5f3275a619a224ff5e867039b30a147291db8d0508f72e8a24b674273062cff6
MD5 d462b957f90310ef2d4b3406b02b0887
SHA1 2b61ed8e77ab4d63bbb33894dddc56d35741d8a6
SHA512 41fa681124a3e5acf3edecd6d996b868aeaeb7e55cce2d9dbdafc12f2435c819133bd18105481ba20a05e174c617df777e5cddf6067cbb9df789b1d300de090e
SSDEEP 3072:EcVZDNmywB9hgBtZZXMDcpeCOIVyVQBpd2SzAfQFrr2b2DwiItzyxyAtwy8I:EsNwBjItZZXMgp5PVyVQBppzAf2uj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4376	4336	rundll32.exe	83
PID 4336 wrote to memory of 4376	4336	rundll32.exe	83
PID 4336 wrote to memory of 4376	4336	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll,#1
  2⤵
  PID:4376