10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d

Analysis

max time kernel
198s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 16:07

Target

GDHM_TASBOT_v35.6/.GDHM/tools/backup/msacm32.dll
Size

49KB
MD5

b716117f2a7a40be7ee08581763d08a5
SHA1

18807ae8c24fbefb08dbc2392c9a7a3219e95778
SHA256

330018168f76437f51c21964c5c5f96193c655b586597ec599145c905389f88a
SHA512

d5b4e6c745ae4075317c1288130dee6a39ef50ed7d57efa1592e31e573f9d56226ff8a43d6491249a9d272c6f25b17027a6f770347a7cb4c1f988d243d77f498
SSDEEP

768:zLSYj3GicWa/sxEF6rQ030shvY0YQW8Wn9muQo0UzN2hiV9J1Ss:3Sm6sxI6rQ7shwqWn9mNo0UzPR1S

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3852 wrote to memory of 2216	3852	rundll32.exe	rundll32.exe
PID 3852 wrote to memory of 2216	3852	rundll32.exe	rundll32.exe
PID 3852 wrote to memory of 2216	3852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\.GDHM\tools\backup\msacm32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\.GDHM\tools\backup\msacm32.dll,#1
2⤵
PID:2216