872526553c142dd97e6d06e2894bab3c80a2447d8cb6d2bbe249d295d63f49dc

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 19:56

Target
872526553c142dd97e6d06e2894bab3c80a2447d8cb6d2bbe249d295d63f49dc.dll
Size 51KB
Sample240227-ynxjqsab34
SHA256 872526553c142dd97e6d06e2894bab3c80a2447d8cb6d2bbe249d295d63f49dc
MD5 3973488ab40f9e595c7fc920bb2b0a17
SHA1 60194df15b7cb3bb18375173d7af7e0ab1ae7bc6
SHA512 8b3f29f6dbabbe0264daa923a18e4c65fd3bd7734ebfd56a39ccbce6f353c362ac6cad500a70d5455d015cdd56eafcb3cf3a844a1becf976dd264c8ed57e303a
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLBJYH5:1dWubF3n9S91BF3fboFJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3496	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3496	2272	rundll32.exe	86
PID 2272 wrote to memory of 3496	2272	rundll32.exe	86
PID 2272 wrote to memory of 3496	2272	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\872526553c142dd97e6d06e2894bab3c80a2447d8cb6d2bbe249d295d63f49dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\872526553c142dd97e6d06e2894bab3c80a2447d8cb6d2bbe249d295d63f49dc.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3496