94b5a5cc5729f6531032abf15914f57f7f6f6f7cb31fa816373e412ec4ade1fd

Analysis

max time kernel
495s
max time network
1597s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04-07-2024 19:21

Target

UltimMC/libwinpthread-1.dll
Size

48KB
MD5

d128ae39a79e5d196fc001907b5ec3d1
SHA1

71de74d0aa93903e0a169c88fd21e0c617f0660a
SHA256

4195ac1e3a4a8056de42c31d511e0e595772439adba96180b8953ef5f135f7a5
SHA512

5b32eb7e2f01fb17ed0c4434a525ae3056acddde75c32c5036c18b6f2ffa4cf80cfee9bab4c824ca313e6e33114ea0e761dc8f75db3bbbbe4319c079848a3c06
SSDEEP

768:NdOT5wjxqOfH36THnf/GcTuI4bOBxZXmVwDI7dTBhkSoFrg22222222222A26wiB:rE5wtqOfX6T/uDIm4xZ2WI7jhkSoFHij

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4960 wrote to memory of 3020	4960	rundll32.exe	rundll32.exe
PID 4960 wrote to memory of 3020	4960	rundll32.exe	rundll32.exe
PID 4960 wrote to memory of 3020	4960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libwinpthread-1.dll,#1
2⤵
PID:3020