4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 19:57

Target

4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f.dll
Size

50KB
MD5

2b86a0794c314b189b9780e1c5fd73c8
SHA1

2dfba73b97be5c14a8319dda9096b42042565caa
SHA256

4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f
SHA512

baf1bd9c8298f56df9df030a2a5c8dbb70acafce1b4355e5c7741db04da2590eeb82f085fd9428081c42300a5e86fa8b4e8bc6f24446c932a5b517c07833da9a
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5aJYH:W5ReWjTrW9rNPgYo4JYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1576	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1576	2944	rundll32.exe	89
PID 2944 wrote to memory of 1576	2944	rundll32.exe	89
PID 2944 wrote to memory of 1576	2944	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4689d4bef4e60923caca5b5a02d02dd175c7b4254623a135a67adfccdf39e60f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1576