608c968dc93e1ac51064b57cb65d757ef33b4b718be900a53d3cde78afcb6194

Analysis

max time kernel
134s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:12

Target

608c968dc93e1ac51064b57cb65d757ef33b4b718be900a53d3cde78afcb6194.dll
Size

899KB
MD5

f1168877226e271192cce419731fe742
SHA1

c4e7825297638ae8f74b2579c56a7292fbeb3954
SHA256

608c968dc93e1ac51064b57cb65d757ef33b4b718be900a53d3cde78afcb6194
SHA512

12397166f35b0296298946fc96db980eef210c39186b1ce060c2ee5ee1851899aa1a06b4cf3b95a9d8ecbfd67dc2cd5678d478a12cd64beb70084502a8b593a6
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX8:7wqd87V8

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2716	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2716	3260	rundll32.exe	85
PID 3260 wrote to memory of 2716	3260	rundll32.exe	85
PID 3260 wrote to memory of 2716	3260	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\608c968dc93e1ac51064b57cb65d757ef33b4b718be900a53d3cde78afcb6194.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\608c968dc93e1ac51064b57cb65d757ef33b4b718be900a53d3cde78afcb6194.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2716