45446f6e7551da01e6b6eca54c82f5584b34fa5b71517e2f3977939dfb0e876b

Analysis

max time kernel
1739s
max time network
1155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 01:29

Target

System.ComponentModel.TypeConverter.dll
Size

670KB
MD5

b2b20f486bce77aea4acdc0195d56c46
SHA1

78d478807584b76f5a83d7ba6dd65aed608a0b95
SHA256

d6a0dd732563d4d2e9af1399fbb30a6799b48289106bc5535a399d750d02b7ec
SHA512

5e3983604d498ef09b8f4db58c4bfdfd16ca44270c5611c3ceb0e059803869e30f008aec2f4d6a76e91683f56dab600205f746064c1c64c20fe142c93d777adc
SSDEEP

12288:F0LVBGq3r2i++kwEHebAllWw6bq+YDMpBiXxDwDgSsr+lJDAr5chv90:azGqi7+kwEHebA5SRyMpBizSsrUQ5Qa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 400 wrote to memory of 4480	400	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 4480	400	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 4480	400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.TypeConverter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.TypeConverter.dll,#1
  2⤵
  PID:4480