1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 15:10

Target

1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10.dll
Size

50KB
MD5

823a5709c53c8a64d62ccd3121f0c0e9
SHA1

924b02537a04edc69dc5fb3b5983a486687cb197
SHA256

1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10
SHA512

a76bbd4ba521883f0b79452302c84230fe423d15feefc40ea5503d7fa61d443f19b55c87a9e2e257c8069b476fd6cfd3ff6fb005bab1c3d95e0255c3bc76e13b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5AJYH:W5ReWjTrW9rNPgYoGJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3436	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3436	3916	rundll32.exe	90
PID 3916 wrote to memory of 3436	3916	rundll32.exe	90
PID 3916 wrote to memory of 3436	3916	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cdb44259b0b294e89f1f89a5691f1c6511a4a6830671ec86c9bfc5b01d45b10.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3436