45446f6e7551da01e6b6eca54c82f5584b34fa5b71517e2f3977939dfb0e876b

Analysis

max time kernel
1355s
max time network
1152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 01:29

Target

System.ComponentModel.EventBasedAsync.dll
Size

46KB
MD5

85d20e23388d25b8955b02fab8d2c1e0
SHA1

7cda8864afa3bd85fe6be57719731ee41989849d
SHA256

98ccfbdc64490d49b5893288e7acad0831eefc015b9743b75aac146e599df9a9
SHA512

21c9a325361ba8c989b61801fb63e7ca1d5a95aaa2bb6c8fd0f3875d9104f79e8fb694b852497b008f4f9ee259468841be7e490e4df34eb816a00b0157f7e795
SSDEEP

384:bWTwWifTTZa1IdWBj/D3fM57bQfL9XkWovbJKfCvDXxO88+aEZ4jIwVQBvyW1QUg:0Dlzfw7EBWd88IVq4F/it9zO/f

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4500 wrote to memory of 376	4500	rundll32.exe	rundll32.exe
PID 4500 wrote to memory of 376	4500	rundll32.exe	rundll32.exe
PID 4500 wrote to memory of 376	4500	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.EventBasedAsync.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.EventBasedAsync.dll,#1
  2⤵
  PID:376