db92d340469fe3499578a8041ecf7a5e62b3434cea807b16aad2eee7e99f0afd

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 22:31

Target

db92d340469fe3499578a8041ecf7a5e62b3434cea807b16aad2eee7e99f0afd.dll
Size

899KB
MD5

959f00031eda6549166cd69750cf2277
SHA1

7c632e0f695a2f7332a69cf290fea26df657a26c
SHA256

db92d340469fe3499578a8041ecf7a5e62b3434cea807b16aad2eee7e99f0afd
SHA512

b554da45af60efcfe8d1f7e5c5a347c27e7b827e9a7c3b8026d270cf6164fba78bc83a2adaddf4e4d13ba72506096cc3f01d9fbfd7c925cee9abfc5e3992849a
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXJ:7wqd87VJ

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1252	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1252	1596	rundll32.exe	59
PID 1596 wrote to memory of 1252	1596	rundll32.exe	59
PID 1596 wrote to memory of 1252	1596	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db92d340469fe3499578a8041ecf7a5e62b3434cea807b16aad2eee7e99f0afd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db92d340469fe3499578a8041ecf7a5e62b3434cea807b16aad2eee7e99f0afd.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1252