ba2f2e8f23015035d16be8378c5e30d42b8a6419dae1a9f50ddb0a358175a159

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 13:40

Target

App/ProgramFiles/freetype6.dll
Size

538KB
MD5

5155ae6efacc75084fb1a9884be552ea
SHA1

b4a7cc2eb2134a6d06f0a5fe68d2c64db9e89f4e
SHA256

2f44cbfe8b02974e029fa4b97f4bc342553167d6f715be082f8f52ac604cbb66
SHA512

579280ed5415b2fc56e424d5026da50809c4723a09eb6ebdbe00ceddacf549bf0cf6d43ee411d72c777c6bc0ddec5d565fbc8278703aa3c7e8823b08c11d6782
SSDEEP

12288:0sjQRl3iZwl3JBrySD9CkkJC28DWl0RJK2LgAN4cGDy3+uZ:0sWZiZCCMCkkMRDeSjcjcGDyJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 4408	3896	rundll32.exe	84
PID 3896 wrote to memory of 4408	3896	rundll32.exe	84
PID 3896 wrote to memory of 4408	3896	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\freetype6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\freetype6.dll,#1
  2⤵
  PID:4408