15d2562daa1b25c394a18ba8995ae1801b6fc4c3690b89f135c01dd52ecc8bfb

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 19:37

Target

15d2562daa1b25c394a18ba8995ae1801b6fc4c3690b89f135c01dd52ecc8bfb.dll
Size

50KB
MD5

18af578d6af130520c71b54ff40e0889
SHA1

3e0cc195406a39e6a9ea63dc6b344c264353040c
SHA256

15d2562daa1b25c394a18ba8995ae1801b6fc4c3690b89f135c01dd52ecc8bfb
SHA512

50f50449312f57c5f60ae90794d891ac28a8c9424c227e69e536db832a37b62ee52b8710cda34a64cd101d6575feaddfc752271a80e14b55acd30f7e91a42eac
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5SJYH:W5ReWjTrW9rNPgYoIJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2612	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2612	5020	rundll32.exe	24
PID 5020 wrote to memory of 2612	5020	rundll32.exe	24
PID 5020 wrote to memory of 2612	5020	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d2562daa1b25c394a18ba8995ae1801b6fc4c3690b89f135c01dd52ecc8bfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d2562daa1b25c394a18ba8995ae1801b6fc4c3690b89f135c01dd52ecc8bfb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2612