ac264989c134d2440a582d853f8732340b92e51a9c3a90226bd5fb5e56d3aff5

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:32

Target

ac264989c134d2440a582d853f8732340b92e51a9c3a90226bd5fb5e56d3aff5.dll
Size

899KB
MD5

cdb22c8f4d5eb5dd489f79af0aff32d9
SHA1

ece28592b6daa4a4ce322e5ec8816288ecf8b9ab
SHA256

ac264989c134d2440a582d853f8732340b92e51a9c3a90226bd5fb5e56d3aff5
SHA512

b7ede8a18bd0b081430869c178d8b8f57c05e710f9578c63f31cdb4f8cccd71ff24ee081528dc2fc917ca60976a6f504ddfb0f4087f45280b6c16112c5c0b3b5
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXq:7wqd87Vq

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5084	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 5084	2924	rundll32.exe	14
PID 2924 wrote to memory of 5084	2924	rundll32.exe	14
PID 2924 wrote to memory of 5084	2924	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac264989c134d2440a582d853f8732340b92e51a9c3a90226bd5fb5e56d3aff5.dll,#1
1⤵
- Suspicious behavior: RenamesItself
PID:5084

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac264989c134d2440a582d853f8732340b92e51a9c3a90226bd5fb5e56d3aff5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924