ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b

Analysis

max time kernel
101s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 22:59

Target

ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b.dll
Size

55KB
MD5

08e016a32cafc2d04e9c2daf266f1990
SHA1

42306fa8c20f9ce176bdc2d6036531eea6e350fe
SHA256

ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b
SHA512

a8f0c7236c2cedd8cc7678bb7891714831c037f36c14370f919e10ba15c374f270489122f5e55e82e65faecacee6b67e300d3b7758d2424012769e8c74d73f25
SSDEEP

768:LRBU3zyN0mv7t7T16rKkdeb2hmVfdA7SCrjaHrdkdkM/4CSTvMBO0Kfo2/:LGIfv7t7T1Gd8d6SSeKKyST0Bf4V/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2240	5044	rundll32.exe	81
PID 5044 wrote to memory of 2240	5044	rundll32.exe	81
PID 5044 wrote to memory of 2240	5044	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab0f259c77d49bb41e8dfb47ab63d5c35223b44445604ca55da2cbf018738c9b.dll,#1
  2⤵
  PID:2240

memory/2240-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download