ab454b30c6909655a3a211ccb1f5c7b1c9506836d5ca1f6104b5a943d70c3170

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 20:08

Target
ab454b30c6909655a3a211ccb1f5c7b1c9506836d5ca1f6104b5a943d70c3170.dll
Size 116KB
Sample221028-ywh2badef7
SHA256 ab454b30c6909655a3a211ccb1f5c7b1c9506836d5ca1f6104b5a943d70c3170
MD5 0bd2e3a173611f522d71c73b90003fb0
SHA1 ce03f80ee3261aabca2349194021492a57d2f4d1
SHA512 fc7b911d332142f68467779ba9a5b405d349a3e4c015c96beb010a0ffdf059a3630423b4be58544dcd7149ed9c136334940d5ed605bf1038e04d6df557755732
SSDEEP 1536:wyY8wugEwOVEXdz70e4gI/dEKT7NsywU/un2yftInbNUb1gN9KUo0o:wyKF70e4gLKHqLn2xb6jd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 4364	2724	rundll32.exe	82
PID 2724 wrote to memory of 4364	2724	rundll32.exe	82
PID 2724 wrote to memory of 4364	2724	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab454b30c6909655a3a211ccb1f5c7b1c9506836d5ca1f6104b5a943d70c3170.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab454b30c6909655a3a211ccb1f5c7b1c9506836d5ca1f6104b5a943d70c3170.dll,#1
  2⤵
  PID:4364

memory/4364-133-0x0000000074D90000-0x0000000074DB1000-memory.dmp

Download

memory/4364-134-0x0000000074D90000-0x0000000074DB1000-memory.dmp

Download