ab1679a9f3394413817c517a9388a6687a104e0309b2b2ce405d93373c2641e1

Analysis

max time kernel
103s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 00:16

Target

ab1679a9f3394413817c517a9388a6687a104e0309b2b2ce405d93373c2641e1.dll
Size

61KB
MD5

0aaae3b13f40937c36fe33b349e9f800
SHA1

cd0a8325b39f2b3545f96acd6849074b1591b5d4
SHA256

ab1679a9f3394413817c517a9388a6687a104e0309b2b2ce405d93373c2641e1
SHA512

53b8fc32d81bbea0f23fe069706e6250392a164e4bce26161dcb84b4d0acec5d301a2358f0e07780b2534c3a13098bf9744e182736000218acb5c6aa255f89a3
SSDEEP

1536:9CPclndsAdpKpefU3yFtIeGQsLggVCZsgD:IPclqAKAfMyFWeGQC0T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4052	1540	rundll32.exe	17
PID 1540 wrote to memory of 4052	1540	rundll32.exe	17
PID 1540 wrote to memory of 4052	1540	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab1679a9f3394413817c517a9388a6687a104e0309b2b2ce405d93373c2641e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab1679a9f3394413817c517a9388a6687a104e0309b2b2ce405d93373c2641e1.dll,#1
  2⤵
  PID:4052