ab48ac56b44d51a30fd08e25088cc764d62f72ea086f2e11b596617412f2bcfd

Analysis

max time kernel
156s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 04:34

Target

ab48ac56b44d51a30fd08e25088cc764d62f72ea086f2e11b596617412f2bcfd.dll
Size

72KB
MD5

67dbc5f1329b92be5ee24de516905950
SHA1

a503997714b95339db202b958c8148c9290039c1
SHA256

ab48ac56b44d51a30fd08e25088cc764d62f72ea086f2e11b596617412f2bcfd
SHA512

6da2932aeb9fecd3a264321b7dc944f19f37ffe29c8bbb90fd78e76655e5eb5941eb862714328632da283aede4d0dc32a30727a8110dd77d8b70356166919d2c
SSDEEP

1536:Jd8cHHQR/kgZEbVxH4ujLuJnL2H4V4LWMF1dlF/80Qpp5:jfHccmEbvH4iRY+LWMF3lCp5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4752	4692	rundll32.exe	80
PID 4692 wrote to memory of 4752	4692	rundll32.exe	80
PID 4692 wrote to memory of 4752	4692	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab48ac56b44d51a30fd08e25088cc764d62f72ea086f2e11b596617412f2bcfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab48ac56b44d51a30fd08e25088cc764d62f72ea086f2e11b596617412f2bcfd.dll,#1
  2⤵
  PID:4752

memory/4752-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download