c5a44b3d265b10212fe02cc581453d1fe751d30091282e1e2217c73ab196a232

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 15:00

Target

api-ms-win-crt-stdio-l1-1-0.dll
Size

23KB
MD5

b460c0a6b145fb30002fc6e1f70a4f7c
SHA1

8ace170b9709e2d7854e4a5385bf05886b16ee26
SHA256

cae1208c3bded797336dba2fca5dad3923b99d026e850c802327ce5555e35775
SHA512

7419bf32dcc66b44671d024f226d92d2e3f7b53829ce9fe25c6a3b9fda35831557650d0e87385b54c84f6fe762f142518984050b9377110bd59a2aaafa3e5f97
SSDEEP

384:NZpFVhHW1hWGq8nw0YHNfPfLeEdtpBjdYNi6Cf3Kd8pUcl3CbFe:lo5bYBbeElrYs6Co8pUfFe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3620 wrote to memory of 4472	3620	rundll32.exe	86
PID 3620 wrote to memory of 4472	3620	rundll32.exe	86
PID 3620 wrote to memory of 4472	3620	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-stdio-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-stdio-l1-1-0.dll,#1
  2⤵
  PID:4472