21733581eee923e4e1c14507a9adf3ff68abb5c5e21b65e8ac1f1c82c82e9f12

Analysis

max time kernel
165s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 01:05

Target
21733581eee923e4e1c14507a9adf3ff68abb5c5e21b65e8ac1f1c82c82e9f12.dll
Size 899KB
Sample240108-bfzb2ahdhj
SHA256 21733581eee923e4e1c14507a9adf3ff68abb5c5e21b65e8ac1f1c82c82e9f12
MD5 1fabeb013aca400ad04f5cae0a85e49b
SHA1 62b786101a02ed49d58b7ef116f19acf5017818f
SHA512 3b264ac5293acaebd3aec2845c24b6fac35e82104483b85222cbac32c115c57f895503d668373f2d695f8bc2472663964526d1a36f1acf4dda199a6b43f79cc5
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX/:7wqd87V/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4968	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4968	3608	rundll32.exe	89
PID 3608 wrote to memory of 4968	3608	rundll32.exe	89
PID 3608 wrote to memory of 4968	3608	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21733581eee923e4e1c14507a9adf3ff68abb5c5e21b65e8ac1f1c82c82e9f12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21733581eee923e4e1c14507a9adf3ff68abb5c5e21b65e8ac1f1c82c82e9f12.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4968