ab248a181d2f1e48da0308c8e3b0ee68c531e2d347b36160e8dcb126f6103198

Analysis

max time kernel
61s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 23:12

Target

ab248a181d2f1e48da0308c8e3b0ee68c531e2d347b36160e8dcb126f6103198.dll
Size

135KB
MD5

4080bfe4b15b0548aedbf2d54f07fead
SHA1

afb46fe1f5dc20f7b4b70eb92bd301eba49b10d8
SHA256

ab248a181d2f1e48da0308c8e3b0ee68c531e2d347b36160e8dcb126f6103198
SHA512

9649a2322978331d6573d89b6e6a787f148d8927fe250e3324ba5ca1f2e6466367abf1d9dac9695116eeccbae5a68b7222a9fa9ad7552e5803154252dcd142ed
SSDEEP

3072:o0yBCVZ/3jeJF4OBmWU7ZEAi0Gv7YHZE76VuLFUSfSEp:o0yk/3jewQmWU7Zpi5YHaVLa7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1584	1884	rundll32.exe	83
PID 1884 wrote to memory of 1584	1884	rundll32.exe	83
PID 1884 wrote to memory of 1584	1884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab248a181d2f1e48da0308c8e3b0ee68c531e2d347b36160e8dcb126f6103198.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab248a181d2f1e48da0308c8e3b0ee68c531e2d347b36160e8dcb126f6103198.dll,#1
  2⤵
  PID:1584

memory/1584-133-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download