a2846d6fbb411df1efb9c21112956ef8b9b2468396982a4778f1f7c7c8222c68

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 19:34

Target

a2846d6fbb411df1efb9c21112956ef8b9b2468396982a4778f1f7c7c8222c68.dll
Size

51KB
MD5

62a4cbcdac8e169462b670fc3bf84f2b
SHA1

6217c5066d31a63b40fbdffe94c33f7ad804aae0
SHA256

a2846d6fbb411df1efb9c21112956ef8b9b2468396982a4778f1f7c7c8222c68
SHA512

7b08e30f8fef487bd7e6c29bb211caadf0e951ae39157ff5127b1a579c5feb54b8818a66e6bbc0004e28b0eb4b5bae6b27f9f54593b2d7fd439dd0d395678d06
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboJJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
412	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 412	5096	rundll32.exe	60
PID 5096 wrote to memory of 412	5096	rundll32.exe	60
PID 5096 wrote to memory of 412	5096	rundll32.exe	60

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2846d6fbb411df1efb9c21112956ef8b9b2468396982a4778f1f7c7c8222c68.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2846d6fbb411df1efb9c21112956ef8b9b2468396982a4778f1f7c7c8222c68.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:412