b34382877e30ad300d113b5045f474fb7cb51bdcbbabc283b868ec50c4b80198

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 01:07

Target
b34382877e30ad300d113b5045f474fb7cb51bdcbbabc283b868ec50c4b80198.dll
Size 51KB
Sample240108-bgzzysaeg6
SHA256 b34382877e30ad300d113b5045f474fb7cb51bdcbbabc283b868ec50c4b80198
MD5 e8256f383aeec185f6d94ae683788406
SHA1 53644df510c734bc73318fdc2bffac808587ebf9
SHA512 1944f3a3b837b175c68fc9fb7cd1e6b5cf176eefeffb211b96a9c9cbd5db731c2f8e795d9e512ff26fcf21fb292338ab53e51d5e2514c064012b6f70d5b8be0b
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLgJYH5:1dWubF3n9S91BF3fboUJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 908	3560	rundll32.exe	14
PID 3560 wrote to memory of 908	3560	rundll32.exe	14
PID 3560 wrote to memory of 908	3560	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b34382877e30ad300d113b5045f474fb7cb51bdcbbabc283b868ec50c4b80198.dll,#1
1⤵
- Suspicious behavior: RenamesItself
PID:908

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b34382877e30ad300d113b5045f474fb7cb51bdcbbabc283b868ec50c4b80198.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3560