032b88cc95f651eedd2bf1cb82d5f18f5950a3fe27c8b4bc9cf1e572f4cb90d8

Analysis

max time kernel
147s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 02:13

Target
c76b705d80d69825a50dfbf09fe32354.dll
Size 77KB
Sample240314-cng86aad25
SHA256 032b88cc95f651eedd2bf1cb82d5f18f5950a3fe27c8b4bc9cf1e572f4cb90d8
MD5 c76b705d80d69825a50dfbf09fe32354
SHA1 807d83a2085714d25ed59a53578137eede86fc03
SHA512 99e4dcdc3aece58c725be8568201aee7bee25c8e21f168099fcd642217a132cd7018ae725bf76f5189a0565674ce90b871c11bdc1f50c8f92a071288726abd40
SSDEEP 1536:8fzq3uNS6IAXHiDX20ERdgm02XkR4LPSCCyfyjkr:YTNNIAyT27F0m24LPSCQjc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 26 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3888	3496	rundll32.exe	88
PID 3496 wrote to memory of 3888	3496	rundll32.exe	88
PID 3496 wrote to memory of 3888	3496	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c76b705d80d69825a50dfbf09fe32354.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c76b705d80d69825a50dfbf09fe32354.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888

memory/3888-0-0x0000000010000000-0x0000000010073000-memory.dmp

Download