de43a9c57ac1f848e19c4e8ae5101af9504a21e9c9cbc51010b12d864f949b07

Analysis

max time kernel
171s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 23:06

Target

de43a9c57ac1f848e19c4e8ae5101af9504a21e9c9cbc51010b12d864f949b07.dll
Size

50KB
MD5

f5cda89735c830f00ca2589eb4708fca
SHA1

3f3298a57a72b8311da36d0179d31d7627a4331d
SHA256

de43a9c57ac1f848e19c4e8ae5101af9504a21e9c9cbc51010b12d864f949b07
SHA512

27a058c9c3c86efbbbd48d335f10b8c65c3be7ec541abf434f396cff60fd1c49a655b1367b067c18edd0024a8e9a0a7083538fbd69d7aec9df0d8479f912245b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5pJYH:W5ReWjTrW9rNPgYonJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4924	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 4924	1812	rundll32.exe	88
PID 1812 wrote to memory of 4924	1812	rundll32.exe	88
PID 1812 wrote to memory of 4924	1812	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de43a9c57ac1f848e19c4e8ae5101af9504a21e9c9cbc51010b12d864f949b07.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de43a9c57ac1f848e19c4e8ae5101af9504a21e9c9cbc51010b12d864f949b07.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4924