9aa91e62da8113855a74e606eadbe7ac3540537295a124d2c6527b45222f90a0

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 01:47

Target

9aa91e62da8113855a74e606eadbe7ac3540537295a124d2c6527b45222f90a0.dll
Size

899KB
MD5

636878ed2560c0c752e0e17628d800b0
SHA1

b485bc5f41238c050858aae7834889df7f328dd0
SHA256

9aa91e62da8113855a74e606eadbe7ac3540537295a124d2c6527b45222f90a0
SHA512

f9f995d10d1264f2730d78f718fda437f148c292e5553ed25d0ee9e593ac714507d84ef6a609da48a808f6774aad69020d6db5a6ca1c5eca93c4c521a7d831a3
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX7:7wqd87V7

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2232	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2232	2124	rundll32.exe	83
PID 2124 wrote to memory of 2232	2124	rundll32.exe	83
PID 2124 wrote to memory of 2232	2124	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aa91e62da8113855a74e606eadbe7ac3540537295a124d2c6527b45222f90a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aa91e62da8113855a74e606eadbe7ac3540537295a124d2c6527b45222f90a0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2232