70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3

Analysis

max time kernel
70s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 14:36

Target
70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3.dll
Size 51KB
Sample231009-ry2g4sde2w
SHA256 70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3
MD5 13111c097548256c90a00bf9bbe1b295
SHA1 e480233581a33037a79497cde3ee205b37e2177c
SHA512 f14f9c7cb4af02394474ee94a1d25462a16a35fcbf7ff6268ccf321273154de0c1212dda692a54bee9bb58f544d3ec90caf1066ddfd1d73711372202f0c4c9ea
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLUJYH5:1dWubF3n9S91BF3fbowJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4416	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4416	4540	rundll32.exe	86
PID 4540 wrote to memory of 4416	4540	rundll32.exe	86
PID 4540 wrote to memory of 4416	4540	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4416