79a3c4f4f102c04d13acca3e78a05f7e3856685aa4413635296e5f06cb74af04

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 16:02

Target

79a3c4f4f102c04d13acca3e78a05f7e3856685aa4413635296e5f06cb74af04.dll
Size

50KB
MD5

a6cf9f3e046584572bdbe4b4ac3cdb3b
SHA1

fcf5935ea26db975d9ca9fd107b0937fa35bc1d1
SHA256

79a3c4f4f102c04d13acca3e78a05f7e3856685aa4413635296e5f06cb74af04
SHA512

c5cc934433f83ed2181a063467ee95a8d9aa88218e91087b919b64913c2240e5a1bff7257d3f733fc0fb010c9b10934187f323d803a501148c58a3c7385ba451
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5jJYH:W5ReWjTrW9rNPgYoFJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1096	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1096	4928	rundll32.exe	85
PID 4928 wrote to memory of 1096	4928	rundll32.exe	85
PID 4928 wrote to memory of 1096	4928	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79a3c4f4f102c04d13acca3e78a05f7e3856685aa4413635296e5f06cb74af04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79a3c4f4f102c04d13acca3e78a05f7e3856685aa4413635296e5f06cb74af04.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1096