45446f6e7551da01e6b6eca54c82f5584b34fa5b71517e2f3977939dfb0e876b

Analysis

max time kernel
1361s
max time network
1152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 01:29

Target

System.ComponentModel.Primitives.dll
Size

74KB
MD5

66038cd6411961e8de7f43ac5bfdb28d
SHA1

71d00e6e5bbd4962305a2eddfc824cd6e58883ee
SHA256

47db3189335fa63213c955cbe5b23016a2193ecab410ac3553b2f0363a13eef8
SHA512

d5dfe197fb9072bf8d86ebd2128551cc4f268ca6fffc3241b9e2882d5ec43bdd9fd9efcd94c22f2d7d1df9a22782fd54aa21ad6905eb76550194cda4faef55ad
SSDEEP

1536:Jswg/p4WaQgo2i8dYRmmb4dlI79ZvD2ols2+xetj8iF2z6M:Jswg/p4vYj79xD2om2+xlWM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 2284	4028	rundll32.exe	84
PID 4028 wrote to memory of 2284	4028	rundll32.exe	84
PID 4028 wrote to memory of 2284	4028	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.Primitives.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.Primitives.dll,#1
  2⤵
  PID:2284