bab2831ebf52b0641176b4d62a4896971bf3a01343791e2bfb3d21cb85f7fc0a

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 12:27

Target

bab2831ebf52b0641176b4d62a4896971bf3a01343791e2bfb3d21cb85f7fc0a.dll
Size

84KB
MD5

6c1f14cba99ad0b57f4af7ce670bfce0
SHA1

56b82c666deb9ee9a634d8819a6fdbdb2dbeb8ea
SHA256

bab2831ebf52b0641176b4d62a4896971bf3a01343791e2bfb3d21cb85f7fc0a
SHA512

a765a635a09d37e2562bf1e0f518aa21e6d8ec46c60312d302ca8e68a42783a908ef45af7b5ed5a7dfce2bef88cbeaa3f6a44f7ba2bb6081c15916ade9f024dd
SSDEEP

1536:JzbZKhA7nInt7XRLw1GoIVcrSwtCTT0FvOKZTe0eP:JH8hA7InNXBw1vIfwHvOqTeTP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1412	2004	rundll32.exe	78
PID 2004 wrote to memory of 1412	2004	rundll32.exe	78
PID 2004 wrote to memory of 1412	2004	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bab2831ebf52b0641176b4d62a4896971bf3a01343791e2bfb3d21cb85f7fc0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bab2831ebf52b0641176b4d62a4896971bf3a01343791e2bfb3d21cb85f7fc0a.dll,#1
  2⤵
  PID:1412

memory/1412-133-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/1412-134-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/1412-138-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download