aa3a42935c88ee107ba6c3309ef097c6c33e0a463e11b2e930f38378a6f64b8c

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 02:51

Target
ba548fb0433e2536472167a051254a05.dll
Size 500KB
Sample240308-dcdx2ade88
SHA256 aa3a42935c88ee107ba6c3309ef097c6c33e0a463e11b2e930f38378a6f64b8c
MD5 ba548fb0433e2536472167a051254a05
SHA1 2d86ac563bcd39376836666376802680adab2219
SHA512 e84b607d9e76c1f303dfd8051b2b87d63976ecbdef2b91102366db6d6d4e77cf37208a0ab67096d3e45b1a77941c67c1849684252fb54b788e262c5e3f2e740e
SSDEEP 12288:nhxbcg9ZO2sEJAAP9pQbhZG0EsVUg70sH:vbcaZQE59p8Jfug7H
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\c214ca4ece.dl	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\c214ca4ece.dl	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4108	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4108	5064	rundll32.exe	87
PID 5064 wrote to memory of 4108	5064	rundll32.exe	87
PID 5064 wrote to memory of 4108	5064	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba548fb0433e2536472167a051254a05.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba548fb0433e2536472167a051254a05.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  PID:4108

c214ca4ece.dl

Path C:\Windows\SysWOW64\c214ca4ece.dl
Size 34B
SHA256 ad81657886ffbd7466c1e2f58f550d9d6ebcba32e4ac1bcd5528de8521705afc
MD5 134cacca8f221f7e011c56a6e85f5401
SHA1 608d83d6cff45d35d0516543821db27eec7d5492
SHA512 0c85bfd31769164bbae038c5f4895d8d24bb766ddd65c94a7223669c648d8f262f036d93644fc2220583515c870a2df0feb0257a91c3f551bae7ec57358642a5
MD5 SHA1 SHA512

Submit Download