bd9aee48dff22fe0ac15aaf141ac71bef8306554c03879ddc3594f5dbc3e6dde

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 14:35

Target

bd9aee48dff22fe0ac15aaf141ac71bef8306554c03879ddc3594f5dbc3e6dde.dll
Size

4.6MB
MD5

f22095680180e42962792773947b9fb0
SHA1

0466e0c93329974eb2e5d55c96ee618098c1a815
SHA256

bd9aee48dff22fe0ac15aaf141ac71bef8306554c03879ddc3594f5dbc3e6dde
SHA512

8a832ef33a854eba1f0ed914c15c5c111b5b4cc654bcd642a18a65415bb47b730737d6b9c5a2fd731278f2368ade3ef3cfdf6cdfb137dbf1edd9cc0c32667bfd
SSDEEP

49152:bA+mWTW1/w8VgpbwHJxp3OZ5XErMvLOPExXIOx0f5yhZZrj5QJJqCk4Z5q6dxv6K:bpLTLbwpxKXEfPuj5sJqCU1Bqd3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2088	3560	rundll32.exe	85
PID 3560 wrote to memory of 2088	3560	rundll32.exe	85
PID 3560 wrote to memory of 2088	3560	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd9aee48dff22fe0ac15aaf141ac71bef8306554c03879ddc3594f5dbc3e6dde.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd9aee48dff22fe0ac15aaf141ac71bef8306554c03879ddc3594f5dbc3e6dde.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088