bddd2ca59e7ff6cb51c3568295ce62812da3b2eb0caf6bc44be37ec412079a9a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 10:30

Target

15f644fad869b258d9e70a51f00a53d2.dll
Size

164KB
MD5

15f644fad869b258d9e70a51f00a53d2
SHA1

4f51719386f4efe09b684bedbc98224d91ef48e6
SHA256

bddd2ca59e7ff6cb51c3568295ce62812da3b2eb0caf6bc44be37ec412079a9a
SHA512

3987ca38c44524f480a8fef7beb8ed5a0e058139609f82f348e88bbdaa45fe8974f4e77506434224a54222b66eee2ace6f54026b2b970f89f68c7286e6600298
SSDEEP

3072:t1QIX244S6k0m1oP4s0I0vSgohXCttJVeJHoZmvOS/pqy6l:AIX244Hkh1Y4sSvolEV4OS/pqH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2836	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2836	1120	rundll32.exe	88
PID 1120 wrote to memory of 2836	1120	rundll32.exe	88
PID 1120 wrote to memory of 2836	1120	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15f644fad869b258d9e70a51f00a53d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15f644fad869b258d9e70a51f00a53d2.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2836