f3c48135e500ad7bdbe6babd213fce5516bb714eb101863723233be8bd1549fb

Analysis

max time kernel
62s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 05:41

Target

for.asp.dll
Size

338KB
MD5

7ecde55910615def4800597d0af45355
SHA1

3ed39483b7aa0a48c938f0a1142b8354db9be4dc
SHA256

f3c48135e500ad7bdbe6babd213fce5516bb714eb101863723233be8bd1549fb
SHA512

003c55084a959fcb627171cefd067d380f8350fbd5f617577e03e3144cb163f0a4b80b2363c30281e6a0542fc7aa6561405837da3ba479ac0db009b9336c5238
SSDEEP

6144:rGpptTq76Et/NPHn1PdjxFJwMoW9vTWF5K6bVt2Eyfs/nqlbbHyx2f8qo+AwrOn:rG7Nq76qPVltfTvTWF5K6zPyfsyZ+x2e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4652	1696	rundll32.exe	84
PID 1696 wrote to memory of 4652	1696	rundll32.exe	84
PID 1696 wrote to memory of 4652	1696	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\for.asp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\for.asp.dll,#1
  2⤵
  PID:4652