ad9940780b3ce3e69807d1e3487289d76fccbeb4716b334a6f4ade3b880cfb2f

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 17:57

Target

ad9940780b3ce3e69807d1e3487289d76fccbeb4716b334a6f4ade3b880cfb2f.dll
Size

51KB
MD5

acbff3cf96ce34de8cc30890adc3a84f
SHA1

897d15d16b60957962b76af77a9c23bea7fe9699
SHA256

ad9940780b3ce3e69807d1e3487289d76fccbeb4716b334a6f4ade3b880cfb2f
SHA512

bf9d60c14235ffc7976845feee59291b7344c184e4f2aa5b01c03f1ee164c258047ebb668fffe441343196bfb8a3de85836fea9ba175ad3d3c338d58dfdd4277
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+JYH5:1dWubF3n9S91BF3fboKJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4640	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4640	3688	rundll32.exe	89
PID 3688 wrote to memory of 4640	3688	rundll32.exe	89
PID 3688 wrote to memory of 4640	3688	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad9940780b3ce3e69807d1e3487289d76fccbeb4716b334a6f4ade3b880cfb2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad9940780b3ce3e69807d1e3487289d76fccbeb4716b334a6f4ade3b880cfb2f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4640