340b3710352f4446fdccbda281cdbe1c80ba7ce19d4c09db3137240feb9815e0

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 07:54

Target

wlycrqjl/lpk.dll
Size

45KB
MD5

6d69be00f87b765e1cf5c7303a2f4cd6
SHA1

dcfd01e48cb6fd4abfb2168c927751396645fc88
SHA256

3436427ba41d6b61d1cfc198f7bc1b2111ce6a69db83514acceb05c391c8c67c
SHA512

a6f377b6ce9649a3b846c01074307d6dec93882e98de65fa032f65e314cfd71bfffa88b7829c24559b55f6a2b9fcea24728db04314777b27988545fb3efd7867
SSDEEP

768:zojY9P368uUCS77GhGLhLpms1R6o9yHHojY9P:GmP6BS7LL18do9yHSm

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
648	hrl7B7E.tmp
516	vabdau.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vabdau.exe	hrl7B7E.tmp
File opened for modification	C:\Windows\SysWOW64\vabdau.exe	hrl7B7E.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 5104	4820	rundll32.exe	80
PID 4820 wrote to memory of 5104	4820	rundll32.exe	80
PID 4820 wrote to memory of 5104	4820	rundll32.exe	80
PID 5104 wrote to memory of 648	5104	rundll32.exe	81
PID 5104 wrote to memory of 648	5104	rundll32.exe	81
PID 5104 wrote to memory of 648	5104	rundll32.exe	81
PID 516 wrote to memory of 4656	516	vabdau.exe	83
PID 516 wrote to memory of 4656	516	vabdau.exe	83
PID 516 wrote to memory of 4656	516	vabdau.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wlycrqjl\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wlycrqjl\lpk.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Users\Admin\AppData\Local\Temp\hrl7B7E.tmp
    C:\Users\Admin\AppData\Local\Temp\hrl7B7E.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:648

C:\Users\Admin\AppData\Local\Temp\hrl7B7E.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrl7B7E.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Windows\SysWOW64\vabdau.exe

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Windows\SysWOW64\vabdau.exe

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit