fc7de9f717a700ead942596a11728a8962833e4314f62e00b0b81b9a6e555aa9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 11:44

Target

AboveLockAppHost.dll
Size

322KB
MD5

f3b1341309be337f00cac90a5cd4d91f
SHA1

14f06166fcccbf3b00dbab777b0cceb44ace5f1e
SHA256

fc7de9f717a700ead942596a11728a8962833e4314f62e00b0b81b9a6e555aa9
SHA512

5ae865dcd5c98ddb1b9295060108ea3eef5f36cf76b77e3792b5397ffe07b5a3b66f828bfeeed205e0a0183481c397a8edcbe71efb14833e02f835efe5863d82
SSDEEP

6144:6Z/WdKJPCG3zhzpMDtZxlCL7GlbHI44MrfQn2/ZUbw/Ji/AOOQ:6ZedKq6zhyDtZx8LClbHI4y2tJi0Q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3592	4272	rundll32.exe	82
PID 4272 wrote to memory of 3592	4272	rundll32.exe	82
PID 4272 wrote to memory of 3592	4272	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AboveLockAppHost.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AboveLockAppHost.dll,#1
  2⤵
  PID:3592