45446f6e7551da01e6b6eca54c82f5584b34fa5b71517e2f3977939dfb0e876b

Analysis

max time kernel
1682s
max time network
1137s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 01:29

Target

System.Configuration.ConfigurationManager.dll
Size

942KB
MD5

297eb82602c2b3646acbb82ce8548540
SHA1

86f135f81ca2aa6c7217f9443506bf176aaae1d6
SHA256

cf2546b54265efad00c233b7c73d7b0121576308ef9e35ea6eb10c8727cc24bb
SHA512

a38d9380eea3403578eedcbd7b882feb9ccaef7463ba3fd3dd728f557a8f93d3823bbe9fc3649cf6e9ff6da961ce82f7209a946f6cb10fc7585e1ec9bc6618dc
SSDEEP

12288:rGvbfOsdV0Z8oApKK1sPTdokGH5OTNWLOdN2wi3k0nM64/3ABjiqPA5xwqaYp3pg:rZaNm/3gG7Va2/nZ6j9pCFgfIooKp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3420 wrote to memory of 3888	3420	rundll32.exe	rundll32.exe
PID 3420 wrote to memory of 3888	3420	rundll32.exe	rundll32.exe
PID 3420 wrote to memory of 3888	3420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Configuration.ConfigurationManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Configuration.ConfigurationManager.dll,#1
  2⤵
  PID:3888