f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645

Analysis

max time kernel
136s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 08:14

Target

f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645.dll
Size

51KB
MD5

73b73611a499ac4dffc0796703692022
SHA1

456985b5c5b0658430d1322079c85b58082817a3
SHA256

f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645
SHA512

eb05ed0f5eb9555af571166e1f18ae4cf6a71eaba50c5c7e94bac53eb319b83110e962e2095fdd149e36b38e2685c157c0b3396be6329cc9f068ed47df5fef28
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLSJYH5:1dWubF3n9S91BF3fbo+JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4812	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4812	2748	rundll32.exe	86
PID 2748 wrote to memory of 4812	2748	rundll32.exe	86
PID 2748 wrote to memory of 4812	2748	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f794ee7406057c12cb321a4ab4fbf4d2d6160d760fcc319ee2f6357b61c28645.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4812