f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0

Analysis

max time kernel
136s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 00:56

Target

f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0.dll
Size

51KB
MD5

3d96362f1128ee3bff413936f2d0904c
SHA1

bc571be8e2b03c7c467a04db76f2ac8e5ac12d23
SHA256

f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0
SHA512

e7e32937f4d3b333f65052d886e58f4a6b8b878b06e8b2e8376b6b415d3a90ce6ff77b6b649d5571440234f4fc6855b83d614f4746548e229fbcef5cb4264b21
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+XJYH5:1dWubF3n9S91BF3fbo8JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2032	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2032	2780	rundll32.exe	86
PID 2780 wrote to memory of 2032	2780	rundll32.exe	86
PID 2780 wrote to memory of 2032	2780	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6aa9a7e90f0e2d8bace15ae2e15ac3fd97ce0e7760548c774c227c4385298b0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2032