64690e666518ea5fa250cb3f58b626537af21b4ccc4d58a1eebdf0bf11f10077

Analysis

max time kernel
92s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 13:43

Target

api-ms-win-crt-string-l1-1-0.dll
Size

23KB
MD5

b144912affaf4df8ae8a84f5ae2bd722
SHA1

23c5a832433da19dff2c3eb4e5ac03f3492a289a
SHA256

8462cac692d42111aafb52b6eb6740987490e941407ea3921edc3c7306720b12
SHA512

96199647d27ca4b165ded0edfed8feede79e63a01bc0a51140a4b67918ef1c2322321a92afdcad3ed39b634d2f16c04f41a894cfced92c069b0662feb619c0cf
SSDEEP

384:ciFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWw5qYHNfPfLeEdtpBjdYvopf3b5:c6S5yguNvZ5VQgx3SbwA71IkFhLUYBbh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 920 wrote to memory of 1520	920	rundll32.exe	84
PID 920 wrote to memory of 1520	920	rundll32.exe	84
PID 920 wrote to memory of 1520	920	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-string-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-string-l1-1-0.dll,#1
  2⤵
  PID:1520