6a5366248db2357047d739f025ac2625e19d6bb6b12b5e650758e6a54c83de3d

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 14:45

Target

6a5366248db2357047d739f025ac2625e19d6bb6b12b5e650758e6a54c83de3d.dll
Size

50KB
MD5

2049d30c453a98bfa948e506eb97ae47
SHA1

3d39492f29e3caeb9b0859c1a33eaf6225a5e1ae
SHA256

6a5366248db2357047d739f025ac2625e19d6bb6b12b5e650758e6a54c83de3d
SHA512

c23e5bee2c958345d1a524f5f04814b62a46e10b56fe1f7f32d5c8e9c5bf0792d63cb943947a864ec1fe870b83c699fd08454f5ce721891319dca5e491706f83
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5vJYH:W5ReWjTrW9rNPgYoNJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 4800	2932	rundll32.exe	85
PID 2932 wrote to memory of 4800	2932	rundll32.exe	85
PID 2932 wrote to memory of 4800	2932	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a5366248db2357047d739f025ac2625e19d6bb6b12b5e650758e6a54c83de3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a5366248db2357047d739f025ac2625e19d6bb6b12b5e650758e6a54c83de3d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4800