5f5099b3b82b7c6f4a0952de56b702de889a1762b23add4dfc8904987c1d99b7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:15

Target

5f5099b3b82b7c6f4a0952de56b702de889a1762b23add4dfc8904987c1d99b7.dll
Size

51KB
MD5

e1bf9adf928b0e19b60d3ece341d6d30
SHA1

c55aa9eb885ef9f01998106f717b8c993fdc4c8f
SHA256

5f5099b3b82b7c6f4a0952de56b702de889a1762b23add4dfc8904987c1d99b7
SHA512

28a56143e47398686c61e8a8bc9a035f7d9bbdf09b8b3f7fd5eb0e44ef81a82bd04533d8d7b912d51251f3062a5704de42d2d6caa510d45b66387c93381f2d8d
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLQJYH5:1dWubF3n9S91BF3fbo8JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4720	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 4720	3104	rundll32.exe	85
PID 3104 wrote to memory of 4720	3104	rundll32.exe	85
PID 3104 wrote to memory of 4720	3104	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f5099b3b82b7c6f4a0952de56b702de889a1762b23add4dfc8904987c1d99b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f5099b3b82b7c6f4a0952de56b702de889a1762b23add4dfc8904987c1d99b7.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4720