6da9afa3354efaa811ad21f25c2f0c9c71cd42c2e70d460ca60a0ff699fde29f

Analysis

max time kernel
158s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 19:39

Target

6da9afa3354efaa811ad21f25c2f0c9c71cd42c2e70d460ca60a0ff699fde29f.dll
Size

51KB
MD5

afc4414fccd19d119ff41face8fae05d
SHA1

0b6d15a659dd956f341a9ea85537d1e4bfec4271
SHA256

6da9afa3354efaa811ad21f25c2f0c9c71cd42c2e70d460ca60a0ff699fde29f
SHA512

64cebe024f9f088f67880230fc3a56ead5af2ea232c3b57b0c340e3861212f78b8eeab7483d4fb8bfbd382e06d4b83e2ba8e5129b91794f907137f7371b146c6
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLbJYH5:1dWubF3n9S91BF3fboHJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2164	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2164	2188	rundll32.exe	86
PID 2188 wrote to memory of 2164	2188	rundll32.exe	86
PID 2188 wrote to memory of 2164	2188	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6da9afa3354efaa811ad21f25c2f0c9c71cd42c2e70d460ca60a0ff699fde29f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6da9afa3354efaa811ad21f25c2f0c9c71cd42c2e70d460ca60a0ff699fde29f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2164