10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 16:07

Target

GDHM_TASBOT_v35.6/ToastedMarshmellow.dll
Size

19.8MB
MD5

648ec09e3c4cf34bdcad8fd01819c334
SHA1

1072d89df45a0e01163dacdbfb646bd677907a43
SHA256

d08a952ef2a90adaee882607d4b77c4b4deae9d2d956d274f9c958b13d636311
SHA512

16af9b8258ab0258d5d58e88ca0e214f278b518eef5e5164c235ba5957ccb32b7a385b2e6cec57e3fe61a216a524e5608ab4daa164c76c7207a8eaa9549296b2
SSDEEP

393216:bJKxYmaj9Ei74yxJZq2F8qa2mgtG98GyuTk7Lg40pEPFVKEelx/6Dyg:UxRajzc6v62oTlCP2JlgDyg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3872 wrote to memory of 4284	3872	rundll32.exe	rundll32.exe
PID 3872 wrote to memory of 4284	3872	rundll32.exe	rundll32.exe
PID 3872 wrote to memory of 4284	3872	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\ToastedMarshmellow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\ToastedMarshmellow.dll,#1
2⤵
PID:4284