e251f7067f465df132edf578c9b9142304f6c0bac54b000a765cb2ea635b04a1

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 09:41

Target
ab95abc3d0163fd8fffc5137927e3735.dll
Size 91KB
Sample240228-lnvc6age2v
SHA256 e251f7067f465df132edf578c9b9142304f6c0bac54b000a765cb2ea635b04a1
MD5 ab95abc3d0163fd8fffc5137927e3735
SHA1 94ba99e3c6e3740fd0b98b28a46a0d1ec371a442
SHA512 d09c800bab0b83e0fbad0a149a58345811e993d32e0a8bc17fd90d705b77c359aa11feef576090ef50a7eec581ae8376d7b77aeb15ac2935a34e30600be1dd08
SSDEEP 1536:viIasoKl7T7+8mOJrB6xvbcZyFNNyJqVKfR0hktepwjWox9sju6gBz+oe3r6Wic5:viPsf7n+8JJNKZnN4qwfRpjxxsQza4lY
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\set.ini	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3400	1152	rundll32.exe	86
PID 1152 wrote to memory of 3400	1152	rundll32.exe	86
PID 1152 wrote to memory of 3400	1152	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab95abc3d0163fd8fffc5137927e3735.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab95abc3d0163fd8fffc5137927e3735.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:3400

memory/3400-0-0x00000000020C0000-0x00000000020EE000-memory.dmp

Download

memory/3400-2-0x00000000020C0000-0x00000000020EE000-memory.dmp

Download