e515acc35698be105e691a131dacab0ab182dac626b043d2c9c2e990152f6455

Analysis

max time kernel
149s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:32

Target

e515acc35698be105e691a131dacab0ab182dac626b043d2c9c2e990152f6455.dll
Size

51KB
MD5

f36a5a61e47b3f08dd74663d8da0dcb8
SHA1

b565249d41fe9147eb69378f92092b2b819b0239
SHA256

e515acc35698be105e691a131dacab0ab182dac626b043d2c9c2e990152f6455
SHA512

f6ec88f53b408b5a0bdb275dc9fdc776e1858aa79280682a87cc8e16d6012a3aa08bb5c981213bd1fdbb516957a7de2e1b5b8c4bff0b487148e161106aaa9a6e
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLDJYH5:1dWubF3n9S91BF3fboHJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5036	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 5036	1316	rundll32.exe	83
PID 1316 wrote to memory of 5036	1316	rundll32.exe	83
PID 1316 wrote to memory of 5036	1316	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e515acc35698be105e691a131dacab0ab182dac626b043d2c9c2e990152f6455.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e515acc35698be105e691a131dacab0ab182dac626b043d2c9c2e990152f6455.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5036