ba74f49f5daf41d7f3aca21c65568cb9bf916f198d69fdc1efe185db8f466028

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 20:15

Target

ba74f49f5daf41d7f3aca21c65568cb9bf916f198d69fdc1efe185db8f466028.dll
Size

51KB
MD5

6f068d76baaa081af7d7784ae49126dd
SHA1

00c009c251442daf387117e18dd6f99a97dfe5db
SHA256

ba74f49f5daf41d7f3aca21c65568cb9bf916f198d69fdc1efe185db8f466028
SHA512

46120f0bf45d6e6c6419d9a00add5bcf00f2c124198bc4748c6eead4687de3c23f2afe1340cb1bae820b8510c7261b7a96141944e29f0b6126554e9e3a9b2e8c
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLRJYH5:1dWubF3n9S91BF3fboNJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
544	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 544	1036	rundll32.exe	86
PID 1036 wrote to memory of 544	1036	rundll32.exe	86
PID 1036 wrote to memory of 544	1036	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba74f49f5daf41d7f3aca21c65568cb9bf916f198d69fdc1efe185db8f466028.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba74f49f5daf41d7f3aca21c65568cb9bf916f198d69fdc1efe185db8f466028.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:544