b0bd5033b1545f9ed1b89603679254194779391232b2848eb1804591e2dcebbb

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 19:07

Target

b0bd5033b1545f9ed1b89603679254194779391232b2848eb1804591e2dcebbb.dll
Size

51KB
MD5

c0d6fbd43d5dc1b5143e17f517bbb3f3
SHA1

2e6b700ec35c76697a3ac5b0617ac04385ff4ee4
SHA256

b0bd5033b1545f9ed1b89603679254194779391232b2848eb1804591e2dcebbb
SHA512

b96fc2c2d1b070e00c46741bac321a4e7f8becc16933c04941f8a4f7834adeabb36665241a5ff5389c5ac770047ea09cc06949028b5312c1a5dd77d24cb8d689
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLaJYH5:1dWubF3n9S91BF3fbomJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3008	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 3008	1124	rundll32.exe	89
PID 1124 wrote to memory of 3008	1124	rundll32.exe	89
PID 1124 wrote to memory of 3008	1124	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0bd5033b1545f9ed1b89603679254194779391232b2848eb1804591e2dcebbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0bd5033b1545f9ed1b89603679254194779391232b2848eb1804591e2dcebbb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3008