ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16/12/2022, 20:27

Target

ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65.dll
Size

207KB
MD5

daa504c1111ff530e69b9d695cecdc86
SHA1

601cb5ecdf3bde2cb40052cf581a8ca4cd14ec37
SHA256

ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65
SHA512

0fc1a3901bff9bbbc8b7eb9be4bf1a997628527a1c75153508db03548a3811085b7e6c4530952d10bc0c4869291b6f07a8d27353cfe9e76620270bc2f3e2d42e
SSDEEP

6144:1jLruYuhKsgErPpaZD38YhbGcLcSflWTBTos65u:1nrbuhKsg8TNoS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3040	2376	rundll32.exe	80
PID 2376 wrote to memory of 3040	2376	rundll32.exe	80
PID 2376 wrote to memory of 3040	2376	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab2fb3dbe125eb05e481687eef9743892042ec966a64c194722da9c0f01cde65.dll,#1
  2⤵
  PID:3040