9912b2ebb73b15e66fcb94d3b9d72a02fe6e9e4d7502f0d6efde788934d314c2

Analysis

max time kernel
147s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 14:45

Target

9912b2ebb73b15e66fcb94d3b9d72a02fe6e9e4d7502f0d6efde788934d314c2.dll
Size

899KB
MD5

11d8672b928768aa29be8b6b6abd183a
SHA1

f1c314f0e9b67963cea9f84c281927d44a0dd612
SHA256

9912b2ebb73b15e66fcb94d3b9d72a02fe6e9e4d7502f0d6efde788934d314c2
SHA512

e349b6c7c99e11263981738b06ffbb5679cbbf0092e13b6f39908b4be472737b69eb93b3069b9555789802708ccb3348dd076cb2af88e9a4b082674342fdd98d
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXp:7wqd87Vp

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3928	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3928	2084	rundll32.exe	87
PID 2084 wrote to memory of 3928	2084	rundll32.exe	87
PID 2084 wrote to memory of 3928	2084	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9912b2ebb73b15e66fcb94d3b9d72a02fe6e9e4d7502f0d6efde788934d314c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9912b2ebb73b15e66fcb94d3b9d72a02fe6e9e4d7502f0d6efde788934d314c2.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3928