10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d

Analysis

max time kernel
73s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 16:07

Target

GDHM_TASBOT_v35.6/libcef.dll
Size

146.0MB
MD5

3288c65d44d4b7834573735adb9d2e5e
SHA1

0c199bd59c36748926a5add53180a3ccba42a2f5
SHA256

17f2ad8fcfa5f8b10a4b794ab2d777a7e3985c871aebea246c3e9a68b86b2be0
SHA512

1cab073bc1262028a96889a7a40e510245be5a84341586018edacb760bbd8229418799ae3a42c655e908842eefeea0366f8acf86e466decee05e21757545da2d
SSDEEP

1572864:GaS2YewQZFn1iF7nUrv16MW8x79rnqZ8m8D2Az4uXIIjuOlG+/VzJIvZlEI7TDNt:QewOF1x91DJVyivE2T65CqD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1648 wrote to memory of 4712	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 4712	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 4712	1648	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\libcef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\libcef.dll,#1
2⤵
PID:4712