1a04894dc3e968cdb2f9e2a6122e1604a2ad5286e12fdbfc3ada08fbe5cc6295

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 23:44

Target

1a04894dc3e968cdb2f9e2a6122e1604a2ad5286e12fdbfc3ada08fbe5cc6295.dll
Size

51KB
MD5

512c46d9dbf0d377a172741e812b7a83
SHA1

f457871aaddd65f4d492bffe1f6631e26c5dd242
SHA256

1a04894dc3e968cdb2f9e2a6122e1604a2ad5286e12fdbfc3ada08fbe5cc6295
SHA512

97a7e35baf096ba93c93bfd9c32a46a284f035db87b4b1eeac7ceea6d1d4d18aa651427f0fa81a111f189d20fedeeab7f386dc7e46b0cf1dae36fd22d180eb9b
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLJJYH5:1dWubF3n9S91BF3fboFJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4204	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 4204	3260	rundll32.exe	84
PID 3260 wrote to memory of 4204	3260	rundll32.exe	84
PID 3260 wrote to memory of 4204	3260	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a04894dc3e968cdb2f9e2a6122e1604a2ad5286e12fdbfc3ada08fbe5cc6295.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a04894dc3e968cdb2f9e2a6122e1604a2ad5286e12fdbfc3ada08fbe5cc6295.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4204