bf3f52f787d881bae7c677abf619eca6a4b492725c282616badd63a9f77623ab

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 17:58

Target

bf3f52f787d881bae7c677abf619eca6a4b492725c282616badd63a9f77623ab.dll
Size

50KB
MD5

ddfea12eb02e32b6992a0a3f182f1087
SHA1

888eb790e3bf3bc87e8cc8b3bda3799a222a9cc9
SHA256

bf3f52f787d881bae7c677abf619eca6a4b492725c282616badd63a9f77623ab
SHA512

b3b441b944a8697713815d772a11594aa050f255425814cad2043879803aec143ee20dab0fcf068518fd59cf015c24d1fb52a038434ddcda79dbf5a02c69d29c
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5/JYH:W5ReWjTrW9rNPgYoNJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3316	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3316	3896	rundll32.exe	85
PID 3896 wrote to memory of 3316	3896	rundll32.exe	85
PID 3896 wrote to memory of 3316	3896	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3f52f787d881bae7c677abf619eca6a4b492725c282616badd63a9f77623ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3f52f787d881bae7c677abf619eca6a4b492725c282616badd63a9f77623ab.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3316