b19f689d70f378530bd4539f71056f5bceb3541992a93268b2ff24bc529c7b94

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 23:38

Target

b19f689d70f378530bd4539f71056f5bceb3541992a93268b2ff24bc529c7b94.dll
Size

51KB
MD5

1314fe8b4787b77931cc3c860aac299c
SHA1

12db637551b7441a2f655beaf2f910fa03296ec2
SHA256

b19f689d70f378530bd4539f71056f5bceb3541992a93268b2ff24bc529c7b94
SHA512

f95a04fe74b0a46d3d1eac97a3bfa8b97b11741e565168799db6852b0ff9d5c502ea32f1e3160f7ebd3c0b29591320798f4eb78b64d7d051c566424332d09ecd
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLMJYH5:1dWubF3n9S91BF3fboIJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4732	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4732	4708	rundll32.exe	89
PID 4708 wrote to memory of 4732	4708	rundll32.exe	89
PID 4708 wrote to memory of 4732	4708	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b19f689d70f378530bd4539f71056f5bceb3541992a93268b2ff24bc529c7b94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b19f689d70f378530bd4539f71056f5bceb3541992a93268b2ff24bc529c7b94.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4732