a0cbaa1d30c81051528609376fe68d782bed44d5ff2bc4bd17ae57ac77a18758

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 10:18

Target

EverVaccine.dll
Size

648KB
MD5

9a007d0a9a758734605a6a6e8aaa8731
SHA1

0458eac7a75a9f51bd9431cd91e148a4eaa7f9af
SHA256

ff885c94b9e4d36d984e1245a5cb12ac84cd341ab3f611f89bdc2ff58d68308a
SHA512

16aaa7bd1064aca05a5fd64453fb530162b3c885f4a27854a8e62ee1b116bf15ec36af4512b780c75c6f9d0d2d927d362bdf6842449f00786f3211bcb6cb1fe6
SSDEEP

12288:YE2PjGXEH4hiuNOZd9+lG4Vxi++eqeyvhzvjqGKstq2l1GBjxJ:YE2+EH4hlNOZd9+lG4VxibJqxscWGBjx

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2944	rundll32.exe
2944	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 2944	4192	rundll32.exe	88
PID 4192 wrote to memory of 2944	4192	rundll32.exe	88
PID 4192 wrote to memory of 2944	4192	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EverVaccine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EverVaccine.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944