d09b5ce8296bf98bcac7b6ed21fca2183676f7f13a613aa70f737f5959cb9a34

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 22:16

Target

d09b5ce8296bf98bcac7b6ed21fca2183676f7f13a613aa70f737f5959cb9a34.dll
Size

51KB
MD5

3ec361aa00e07ad79d17fce6f8fa4d26
SHA1

0c4316dbf5be4561ba10b4b5f316b6ba46c0235b
SHA256

d09b5ce8296bf98bcac7b6ed21fca2183676f7f13a613aa70f737f5959cb9a34
SHA512

105cbd236cd544a51cbaaaf5c3e03cfb80e242286ec208b9102fc4539de1ef0a96f9ec840e115528b3e4eea367fc1a9b462524f81f7c03baaba1966626d72d7b
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLNJYH5:1dWubF3n9S91BF3fboRJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3940	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 3940	4836	rundll32.exe	84
PID 4836 wrote to memory of 3940	4836	rundll32.exe	84
PID 4836 wrote to memory of 3940	4836	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d09b5ce8296bf98bcac7b6ed21fca2183676f7f13a613aa70f737f5959cb9a34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d09b5ce8296bf98bcac7b6ed21fca2183676f7f13a613aa70f737f5959cb9a34.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3940