64690e666518ea5fa250cb3f58b626537af21b4ccc4d58a1eebdf0bf11f10077

Analysis

max time kernel
36s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 13:43

Target

api-ms-win-crt-multibyte-l1-1-0.dll
Size

25KB
MD5

eff67e06581c9940ddf3faeb5fe1ecfd
SHA1

8311b7ae80f4d58ab8c4105969668f0e7baf57d6
SHA256

06d11b7feb86be22862570751a003a36ca29b8e9586d877e37d757af7b2ec9c5
SHA512

3cc0ac65258e9ca53ba535ca0084dcfe48fac1d15cf20c4d5d4cd96327ceae2418c3dea7cf53b82387fbb1e78a90098350a45f18de587bab17b3f252d752a2ea
SSDEEP

384:Oy+Kr6aLPmIHJI6/CpG3t2G3t4odXLNW1hWq4YYHNfPfLeEdtpBjdY1JK2Mf3bIK:OZKrZPmIHJI6aKYYBbeElrY1RMMrm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2596 wrote to memory of 5092	2596	rundll32.exe	83
PID 2596 wrote to memory of 5092	2596	rundll32.exe	83
PID 2596 wrote to memory of 5092	2596	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-multibyte-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-multibyte-l1-1-0.dll,#1
  2⤵
  PID:5092