df984706d9d3d01d2fbee6226be3713503dce60e0a637ffb467a74e84a5ce9f2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2024 07:40

Target

df984706d9d3d01d2fbee6226be3713503dce60e0a637ffb467a74e84a5ce9f2.dll
Size

51KB
MD5

d7d3bb4c6c6a1cc34dbd4112f86c77e5
SHA1

e9c8bc901d0cde7fa8d54906f35ca7a28c861a8c
SHA256

df984706d9d3d01d2fbee6226be3713503dce60e0a637ffb467a74e84a5ce9f2
SHA512

48f7c863c746d7ac0edb0b9162de0041721def14eb1ba1cf0b813c990324304b5351c6fe4aff91271bfab818841f7ee21ab51f521686451456f3e7a13e313fbf
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezKsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBppMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4136	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4136	5068	rundll32.exe	70
PID 5068 wrote to memory of 4136	5068	rundll32.exe	70
PID 5068 wrote to memory of 4136	5068	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df984706d9d3d01d2fbee6226be3713503dce60e0a637ffb467a74e84a5ce9f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df984706d9d3d01d2fbee6226be3713503dce60e0a637ffb467a74e84a5ce9f2.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4136