10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d

Analysis

max time kernel
129s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 16:07

Target

GDHM_TASBOT_v35.6/msacm32.dll
Size

58KB
MD5

4370295bfda05ab9a876bbb7ad2d0cc7
SHA1

1dd4f4b21d0675b360f19b9327b0941b4b7a4b6b
SHA256

ca291bf5f24d4b70b5a19fabf8da880b36d783922baf6d3e5d651064ccb2e278
SHA512

5736420e9a5db7ca7184845504d0e9ea07dcb36118534b5a6212ca0e5f6300069dca08461e45d93e33468d1aba38766d35819ccd3f3be6aeedfd3bb1fe5c0d0a
SSDEEP

1536:hcdQTSbTdnNhjAbD/UjNyjTsokxyNrWn9mNoamFADO5KR7PJ:yMg5yjTso1C9mNoamFADO07PJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4952 wrote to memory of 2684	4952	rundll32.exe	rundll32.exe
PID 4952 wrote to memory of 2684	4952	rundll32.exe	rundll32.exe
PID 4952 wrote to memory of 2684	4952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\msacm32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\msacm32.dll,#1
2⤵
PID:2684