abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 04:50

Target

abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99.dll
Size

81KB
MD5

bb6daaadb05c9f5e54983ee23f46be60
SHA1

49af0743e567b9cd42860d4f23ca0b4a85da0647
SHA256

abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99
SHA512

4c9002f0db7e11236e47b7147d8fb44be6b334a7396aaf662d717226326c4b04d45050b9b817de8c329993221ed4ee09aefae2b49dbe085980b939b2618a7c4d
SSDEEP

1536:dtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WC:d4v4JKXTx71w0ArSsXF3enq8WC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4180	3960	rundll32.exe	83
PID 3960 wrote to memory of 4180	3960	rundll32.exe	83
PID 3960 wrote to memory of 4180	3960	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99.dll,#1
  2⤵
  PID:4180