9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 00:10

Target

9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46.dll
Size

51KB
MD5

789bf63cd8fbbb23e1ee07a29e41b467
SHA1

949e66bb865611b035857c493fba4ef993a6bcc5
SHA256

9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46
SHA512

bf2e9355f9a208dd0b9c027c231090183217d2be5bbc959ff3b5f9b43a30ff301c3c2c297c9b35a86eac5c4255df3099879860994f4ddd777ddf5904ca5acdaa
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLNJYH5:1dWubF3n9S91BF3fbohJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4928	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4928	2376	rundll32.exe	85
PID 2376 wrote to memory of 4928	2376	rundll32.exe	85
PID 2376 wrote to memory of 4928	2376	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f93813ee4c9a403a54c21dc2a7ec7b742e8539e96d775d29326467951677d46.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4928