5bdf5b5944032b1e62e69e2bdd34edaa49338fd887d7caa3bee51c3432484f5e

Analysis

max time kernel
142s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:09

Target

5bdf5b5944032b1e62e69e2bdd34edaa49338fd887d7caa3bee51c3432484f5e.dll
Size

899KB
MD5

1e8c7569a900818a73e86aca99c37484
SHA1

b431304bc105fb9aa3ca7ff3c35a2e7606fb6443
SHA256

5bdf5b5944032b1e62e69e2bdd34edaa49338fd887d7caa3bee51c3432484f5e
SHA512

05108e304d18f6aec03f923d11869516c8d9963d1c61d2ce4a36029e03100a056c7ed6aa4f4c4bd342d0a2a866390c8b9fc2aead87d39a9345fca7238cb082ad
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXy:7wqd87Vy

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
852	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 852	4992	rundll32.exe	84
PID 4992 wrote to memory of 852	4992	rundll32.exe	84
PID 4992 wrote to memory of 852	4992	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdf5b5944032b1e62e69e2bdd34edaa49338fd887d7caa3bee51c3432484f5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdf5b5944032b1e62e69e2bdd34edaa49338fd887d7caa3bee51c3432484f5e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:852