77022077ed9369b308bc843e2adab1295700393393c23b6bf94d0c20365ec0ae

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 21:45

Target

4c877ac71e62b3afc36406cf706ba45a.dll
Size

49KB
MD5

4c877ac71e62b3afc36406cf706ba45a
SHA1

58dc9c84c7ead1708ae4d07e1437aac90647e003
SHA256

77022077ed9369b308bc843e2adab1295700393393c23b6bf94d0c20365ec0ae
SHA512

c297abfe79f6c808a0318dc3bf82ae596eba57706954bdf261cf5aea62c084e973511deb93d3d5416ab84acf54ec09158fe24e4cf96fc8d09208824fa20a148d
SSDEEP

1536:CDwMsml26T5zBj+alf1H9jfbyqkY4ZvoDUb/gJO1JYHB9ElHS:Cn7zBjPp1H9ovoDa/gJ2JYHBWZS

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3816	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3816	2000	rundll32.exe	88
PID 2000 wrote to memory of 3816	2000	rundll32.exe	88
PID 2000 wrote to memory of 3816	2000	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c877ac71e62b3afc36406cf706ba45a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c877ac71e62b3afc36406cf706ba45a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3816