ab2c44c072abe8bd4706f266faefca4df6d8644b8c180b9f1ae0604cb3dbb394

Analysis

max time kernel
171s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 07:53

Target
ab2c44c072abe8bd4706f266faefca4df6d8644b8c180b9f1ae0604cb3dbb394.dll
Size 31KB
Sample221004-jrc7yaabf5
SHA256 ab2c44c072abe8bd4706f266faefca4df6d8644b8c180b9f1ae0604cb3dbb394
MD5 4f690c3bd41489eebcd4e56bc828ade0
SHA1 7043103e0f9dc6774cbcc0dec15a645833b5319a
SHA512 90c2de3024581eef7c03eb5ae72507257e083f458054e16b9027bfe075c9ac7071b100578bf0cb6b1712ed217315daf6100ea7bde134eed78bbab01238eb949f
SSDEEP 768:f5xQOLlGMJZuQN0r7qHOjGzhqDwR5xuOZ:fXQIGguQg7qH2SksR5ks
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5032	5048	rundll32.exe	81
PID 5048 wrote to memory of 5032	5048	rundll32.exe	81
PID 5048 wrote to memory of 5032	5048	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab2c44c072abe8bd4706f266faefca4df6d8644b8c180b9f1ae0604cb3dbb394.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab2c44c072abe8bd4706f266faefca4df6d8644b8c180b9f1ae0604cb3dbb394.dll,#1
  2⤵
  PID:5032