ab8cbed141040af321acf6a1024d9a756c897b8c09ab9fb39c7899c71851bd4a

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 01:45

Target

ab8cbed141040af321acf6a1024d9a756c897b8c09ab9fb39c7899c71851bd4a.dll
Size

7KB
MD5

50a7bc112fe84104525470e24509abe2
SHA1

9a8d9f36ba6e7f919df4c4fbe56f12059779a991
SHA256

ab8cbed141040af321acf6a1024d9a756c897b8c09ab9fb39c7899c71851bd4a
SHA512

7344926c4dcb3f3fff076b6659d536cb24a1241278c55af7bc959a3529d89624c8b155698eed3591f2e0df35705c6720bfb53bce9fbadfe285993a829e687b8c
SSDEEP

48:Ss0QejYDx6/gB5B65/ic/2hmm3YGebeTKurfUsMbgeOqFmtV766679WDmOI8ZOr+:z0QR9B6BvAwb53i66679WDVI8Z1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1900	5088	rundll32.exe	82
PID 5088 wrote to memory of 1900	5088	rundll32.exe	82
PID 5088 wrote to memory of 1900	5088	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8cbed141040af321acf6a1024d9a756c897b8c09ab9fb39c7899c71851bd4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8cbed141040af321acf6a1024d9a756c897b8c09ab9fb39c7899c71851bd4a.dll,#1
  2⤵
  PID:1900