cab93dde4e4fb98f52e5b95682c3ed21712fb22ff440b70e76fc2e8561fec068

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 19:43 UTC

Target

cab93dde4e4fb98f52e5b95682c3ed21712fb22ff440b70e76fc2e8561fec068.dll
Size

94KB
MD5

aa15d0c4cadbec45fdbdcb60b6ab50f6
SHA1

1c0050d41362f87dad8f0de55dd9117ca91cae01
SHA256

cab93dde4e4fb98f52e5b95682c3ed21712fb22ff440b70e76fc2e8561fec068
SHA512

6af8456072a9a24db0e22d4c62d1e429e29dba05d0f468467d5de051c53fc6bc5ad0bddf3d3d5a398882835e4ffc3115a6da40e42bd80e40a54c7542527625ed
SSDEEP

1536:0cA1HEUZCj/7ica5ZHpTsmhc+3NM2jTE65f2z6OdoIy:s1HEfpcZHpYd+3NM2jTRf2zVdjy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4248	4752	rundll32.exe	70
PID 4752 wrote to memory of 4248	4752	rundll32.exe	70
PID 4752 wrote to memory of 4248	4752	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cab93dde4e4fb98f52e5b95682c3ed21712fb22ff440b70e76fc2e8561fec068.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cab93dde4e4fb98f52e5b95682c3ed21712fb22ff440b70e76fc2e8561fec068.dll,#1
  2⤵
  PID:4248