92d0fdb84d786dd83a36ae46cf7b2c64b4139170b7af30babeb899c190de5bf5

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 04:57

Target

92d0fdb84d786dd83a36ae46cf7b2c64b4139170b7af30babeb899c190de5bf5.dll
Size

50KB
MD5

2ba170cbde11b41b832e7bf9e00e3860
SHA1

77b6978f6e23852438cfdc10e41239f0fcd6c1bd
SHA256

92d0fdb84d786dd83a36ae46cf7b2c64b4139170b7af30babeb899c190de5bf5
SHA512

15e572abf8a54592e47394cbab67517ad6c361f41af3c41a3aea99082091d22d5fc4f0fb7e9ba594bbe43b2325876ff7a691d83d85afad5fdca2d92b034dd8c7
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5aJYH:W5ReWjTrW9rNPgYo4JYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4852	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4852	5048	rundll32.exe	84
PID 5048 wrote to memory of 4852	5048	rundll32.exe	84
PID 5048 wrote to memory of 4852	5048	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d0fdb84d786dd83a36ae46cf7b2c64b4139170b7af30babeb899c190de5bf5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92d0fdb84d786dd83a36ae46cf7b2c64b4139170b7af30babeb899c190de5bf5.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4852