b9ea0745fdb68d9821c794df701ea8ca13bd96c07eb017139ba11f1b4962dd22

Analysis

max time kernel
148s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 09:24

Target

lpk.dll
Size

45KB
MD5

6d69be00f87b765e1cf5c7303a2f4cd6
SHA1

dcfd01e48cb6fd4abfb2168c927751396645fc88
SHA256

3436427ba41d6b61d1cfc198f7bc1b2111ce6a69db83514acceb05c391c8c67c
SHA512

a6f377b6ce9649a3b846c01074307d6dec93882e98de65fa032f65e314cfd71bfffa88b7829c24559b55f6a2b9fcea24728db04314777b27988545fb3efd7867
SSDEEP

768:zojY9P368uUCS77GhGLhLpms1R6o9yHHojY9P:GmP6BS7LL18do9yHSm

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
3388	hrlC7BA.tmp
1996	vabdau.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vabdau.exe	hrlC7BA.tmp
File opened for modification	C:\Windows\SysWOW64\vabdau.exe	hrlC7BA.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4708	4720	rundll32.exe	85
PID 4720 wrote to memory of 4708	4720	rundll32.exe	85
PID 4720 wrote to memory of 4708	4720	rundll32.exe	85
PID 4708 wrote to memory of 3388	4708	rundll32.exe	86
PID 4708 wrote to memory of 3388	4708	rundll32.exe	86
PID 4708 wrote to memory of 3388	4708	rundll32.exe	86
PID 1996 wrote to memory of 4596	1996	vabdau.exe	88
PID 1996 wrote to memory of 4596	1996	vabdau.exe	88
PID 1996 wrote to memory of 4596	1996	vabdau.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Users\Admin\AppData\Local\Temp\hrlC7BA.tmp
    C:\Users\Admin\AppData\Local\Temp\hrlC7BA.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3388

C:\Users\Admin\AppData\Local\Temp\hrlC7BA.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrlC7BA.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Windows\SysWOW64\vabdau.exe

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Windows\SysWOW64\vabdau.exe

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit