23488a63f94a15ef5f92d4089754607e7f9aa9aa7e29e3f65a6e152b8c94d59a

Analysis

max time kernel
509s
max time network
522s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
11-06-2024 01:07

Target

UltimMC/libwinpthread-1.dll
Size

48KB
MD5

d128ae39a79e5d196fc001907b5ec3d1
SHA1

71de74d0aa93903e0a169c88fd21e0c617f0660a
SHA256

4195ac1e3a4a8056de42c31d511e0e595772439adba96180b8953ef5f135f7a5
SHA512

5b32eb7e2f01fb17ed0c4434a525ae3056acddde75c32c5036c18b6f2ffa4cf80cfee9bab4c824ca313e6e33114ea0e761dc8f75db3bbbbe4319c079848a3c06
SSDEEP

768:NdOT5wjxqOfH36THnf/GcTuI4bOBxZXmVwDI7dTBhkSoFrg22222222222A26wiB:rE5wtqOfX6T/uDIm4xZ2WI7jhkSoFHij

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1148 wrote to memory of 4932	1148	rundll32.exe	rundll32.exe
PID 1148 wrote to memory of 4932	1148	rundll32.exe	rundll32.exe
PID 1148 wrote to memory of 4932	1148	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libwinpthread-1.dll,#1
2⤵
PID:4932