1b55900c4db8676056a95e5cb0e4e291f2e74a6b15bc93f68bf0f3269b88d5d9

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 09:36

Target

1b55900c4db8676056a95e5cb0e4e291f2e74a6b15bc93f68bf0f3269b88d5d9.dll
Size

899KB
MD5

6d26bf4c2ff96091f11e70c7218ff727
SHA1

21f46a8c8171d835328d65bf9156582665e3fe66
SHA256

1b55900c4db8676056a95e5cb0e4e291f2e74a6b15bc93f68bf0f3269b88d5d9
SHA512

d7b6f1e7957a256df2dd103818f4c1114eef61d1c1f64cdc63067f65c424b44d6c3f9f13a609ab4b546ba37123d3cee52a67991fd4756b12676b61d4a9a496b4
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXw:7wqd87Vw

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4816	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4816	3476	rundll32.exe	84
PID 3476 wrote to memory of 4816	3476	rundll32.exe	84
PID 3476 wrote to memory of 4816	3476	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b55900c4db8676056a95e5cb0e4e291f2e74a6b15bc93f68bf0f3269b88d5d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b55900c4db8676056a95e5cb0e4e291f2e74a6b15bc93f68bf0f3269b88d5d9.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4816