16f3c2a7d9d9a12f55d5e2600a6c2eab4e1e32514cbfdd2b29da793e11f8a6a0

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 20:11

Target

3dc5cc9af811c1ebb9f561051fd74d19.dll
Size

561KB
MD5

3dc5cc9af811c1ebb9f561051fd74d19
SHA1

ac03ef24496ffd0ebc5178f075791aca9baa912d
SHA256

16f3c2a7d9d9a12f55d5e2600a6c2eab4e1e32514cbfdd2b29da793e11f8a6a0
SHA512

71d2b98a81adba945eae8267faadd65cbddd7a353d407d8166ffc4487c8eafeae01bc3b756d8c6410bf48388011148323f10c45f024b7e4f2f8dcd5abad1b9e6
SSDEEP

12288:EyDOz9flmdUl3jQhLM9i2qvKV5KY7fLl2GdGO6Of:EvhEUZj8M5qCVUYzLl2GIe

Score

8^/10

Blocklisted process makes network request 3 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\6ac7a5200f.dl	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3476	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 3476	2568	rundll32.exe	16
PID 2568 wrote to memory of 3476	2568	rundll32.exe	16
PID 2568 wrote to memory of 3476	2568	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dc5cc9af811c1ebb9f561051fd74d19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568