45446f6e7551da01e6b6eca54c82f5584b34fa5b71517e2f3977939dfb0e876b

Analysis

max time kernel
1558s
max time network
1567s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 01:29

Target

System.Configuration.ConfigurationManager.dll
Size

942KB
MD5

297eb82602c2b3646acbb82ce8548540
SHA1

86f135f81ca2aa6c7217f9443506bf176aaae1d6
SHA256

cf2546b54265efad00c233b7c73d7b0121576308ef9e35ea6eb10c8727cc24bb
SHA512

a38d9380eea3403578eedcbd7b882feb9ccaef7463ba3fd3dd728f557a8f93d3823bbe9fc3649cf6e9ff6da961ce82f7209a946f6cb10fc7585e1ec9bc6618dc
SSDEEP

12288:rGvbfOsdV0Z8oApKK1sPTdokGH5OTNWLOdN2wi3k0nM64/3ABjiqPA5xwqaYp3pg:rZaNm/3gG7Va2/nZ6j9pCFgfIooKp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2348	2704	rundll32.exe	30
PID 2704 wrote to memory of 2348	2704	rundll32.exe	30
PID 2704 wrote to memory of 2348	2704	rundll32.exe	30
PID 2704 wrote to memory of 2348	2704	rundll32.exe	30
PID 2704 wrote to memory of 2348	2704	rundll32.exe	30
PID 2704 wrote to memory of 2348	2704	rundll32.exe	30
PID 2704 wrote to memory of 2348	2704	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Configuration.ConfigurationManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Configuration.ConfigurationManager.dll,#1
  2⤵
  PID:2348