c9f9cec18435a8944b04d7f01eba3fe422d57c2ff679c6cc39930de1d2e1abfc

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2023 11:45

Target

c9f9cec18435a8944b04d7f01eba3fe422d57c2ff679c6cc39930de1d2e1abfc.dll
Size

51KB
MD5

3dfb2f355b898b1cd45aa9666a801f84
SHA1

146b317d2bacecf8e3111793f962435b0e351cc0
SHA256

c9f9cec18435a8944b04d7f01eba3fe422d57c2ff679c6cc39930de1d2e1abfc
SHA512

528fb09650a3addcd58d670709eb5c49647a4d436a44f94cf172f9c271f49a2391624d5a0ee50250033d56305288ab773a64150d823149b7c19460a718d9be22
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLTJYH5:1dWubF3n9S91BF3fboHJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3392	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 3392	4276	rundll32.exe	82
PID 4276 wrote to memory of 3392	4276	rundll32.exe	82
PID 4276 wrote to memory of 3392	4276	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9f9cec18435a8944b04d7f01eba3fe422d57c2ff679c6cc39930de1d2e1abfc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9f9cec18435a8944b04d7f01eba3fe422d57c2ff679c6cc39930de1d2e1abfc.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3392