f6e4199ba359b1bc771bb6f418bb34db714b7698a7309bdcba696b45aaad8b6c

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 23:41

Target

VirusShare-01687166553aa3e02f5e7deed31317c0.dll
Size

140KB
MD5

01687166553aa3e02f5e7deed31317c0
SHA1

d4fdb9c149ed43ecc06d385dd6eccea3b24602ca
SHA256

f6e4199ba359b1bc771bb6f418bb34db714b7698a7309bdcba696b45aaad8b6c
SHA512

26f08f5166496ba9b511acb95376d48815ea49b9a7051e725f310b3598d850feb9c4c2e8ccdaf809488897e961261391d3553efd767c87c133456948146b56c0
SSDEEP

1536:AU3j9mPQQTqudnnG7gJHQqgWJRWFhK1H1Pwkf4/AwCIVNPtljSXIT:1BETqkBJQIRDCPC6ttljSXI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3744	rundll32.exe
3744	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 3744	4024	rundll32.exe	83
PID 4024 wrote to memory of 3744	4024	rundll32.exe	83
PID 4024 wrote to memory of 3744	4024	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare-01687166553aa3e02f5e7deed31317c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare-01687166553aa3e02f5e7deed31317c0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744