6763abda66048f39a5da8b0d6e6d4dd65cdca37b9d0d355a3c6ed7b4e14d83aa

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 13:11

Target
bb593b50311a633addabc6411d70be87.dll
Size 911KB
Sample240308-qfbcjafg74
SHA256 6763abda66048f39a5da8b0d6e6d4dd65cdca37b9d0d355a3c6ed7b4e14d83aa
MD5 bb593b50311a633addabc6411d70be87
SHA1 482a91071f0a9226b4a4ef9ec9cfcafe79f5eed2
SHA512 a4bd695994c0277915e2fb2710b02ceaae765dbdfe45338a5140a4200d185a31d1e60f2466378b9d5bbf86368596a50d46b526466dc6a87d09b9458c6cad65ee
SSDEEP 12288:DauW0INNuTj3kvBGePiI/mKItFWexfY/64prc0jpedqd4hpFzfTOXtHmGGJ:jW0INwv3kvB1iCe03vprleAd4PKmGGJ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\8a202459ac.dl	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\8a202459ac.dl	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2472	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2472	1840	rundll32.exe	84
PID 1840 wrote to memory of 2472	1840	rundll32.exe	84
PID 1840 wrote to memory of 2472	1840	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb593b50311a633addabc6411d70be87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb593b50311a633addabc6411d70be87.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:2472

8a202459ac.dl

Path C:\Windows\SysWOW64\8a202459ac.dl
Size 34B
SHA256 21e098195255772e63bf39eddd705a86292ee3628336084c2ce62a4c24aa8a5e
MD5 19b24fe9abef9482b07356554a22fe1b
SHA1 a227d4294a60d7498c2913efe50ee49c31044228
SHA512 a218873f69ce910218eb6482088eace910cf227aa26ef973e680aeab9a7c10c60ec6a38befb06e2598fb87f99231e1064f52ea87d1cdabeb99febac8c7bfc282
MD5 SHA1 SHA512

Submit Download