6b25c4374d89eebc7c40ea0ef48f3ed719877e1a3ed88351b85f0179fe910ff5

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 14:08

Target

6b25c4374d89eebc7c40ea0ef48f3ed719877e1a3ed88351b85f0179fe910ff5.dll
Size

51KB
MD5

cb5b58eefaad0e316e285b372f96bd50
SHA1

70cd969d6889d796d61366d1a3196256b877e156
SHA256

6b25c4374d89eebc7c40ea0ef48f3ed719877e1a3ed88351b85f0179fe910ff5
SHA512

062049fe7e45101500cab0dc00f1a93a01160615039923a2da1b5f200bc524bedb6a58058ab87eb43827a78d80315b23c89f00eaf399a1558a7a7f0f1f2d2515
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+BJYH5:1dWubF3n9S91BF3fboGJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4004	4080	rundll32.exe	83
PID 4080 wrote to memory of 4004	4080	rundll32.exe	83
PID 4080 wrote to memory of 4004	4080	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b25c4374d89eebc7c40ea0ef48f3ed719877e1a3ed88351b85f0179fe910ff5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b25c4374d89eebc7c40ea0ef48f3ed719877e1a3ed88351b85f0179fe910ff5.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4004