c5a44b3d265b10212fe02cc581453d1fe751d30091282e1e2217c73ab196a232

Analysis

max time kernel
39s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 15:00

Target

api-ms-win-crt-multibyte-l1-1-0.dll
Size

25KB
MD5

eff67e06581c9940ddf3faeb5fe1ecfd
SHA1

8311b7ae80f4d58ab8c4105969668f0e7baf57d6
SHA256

06d11b7feb86be22862570751a003a36ca29b8e9586d877e37d757af7b2ec9c5
SHA512

3cc0ac65258e9ca53ba535ca0084dcfe48fac1d15cf20c4d5d4cd96327ceae2418c3dea7cf53b82387fbb1e78a90098350a45f18de587bab17b3f252d752a2ea
SSDEEP

384:Oy+Kr6aLPmIHJI6/CpG3t2G3t4odXLNW1hWq4YYHNfPfLeEdtpBjdY1JK2Mf3bIK:OZKrZPmIHJI6aKYYBbeElrY1RMMrm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 452 wrote to memory of 4720	452	rundll32.exe	80
PID 452 wrote to memory of 4720	452	rundll32.exe	80
PID 452 wrote to memory of 4720	452	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-multibyte-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-multibyte-l1-1-0.dll,#1
  2⤵
  PID:4720