a4270f39acd51c7a9c17e0142f7aea86ad4d32c4e034d8a4c135b7f681adca54

Analysis

max time kernel
134s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 17:03

Target

a4270f39acd51c7a9c17e0142f7aea86ad4d32c4e034d8a4c135b7f681adca54.dll
Size

51KB
MD5

e7f5adffb59130ed14efb384267676b4
SHA1

601b4bbf2fb2bb11a79ac9b9ac5935926dc70e34
SHA256

a4270f39acd51c7a9c17e0142f7aea86ad4d32c4e034d8a4c135b7f681adca54
SHA512

8290502d376294d7073dc6c6e5709abd2130c1e5cb13eb117d6e8cec2557149a89dab4b9a58d739a91e5a9eb477591e4cc61bbe0176872f6c296806920c90fd1
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLzJYH5:1dWubF3n9S91BF3fboXJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3004	2372	rundll32.exe	83
PID 2372 wrote to memory of 3004	2372	rundll32.exe	83
PID 2372 wrote to memory of 3004	2372	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4270f39acd51c7a9c17e0142f7aea86ad4d32c4e034d8a4c135b7f681adca54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4270f39acd51c7a9c17e0142f7aea86ad4d32c4e034d8a4c135b7f681adca54.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3004