36ca1a526f132bf027e5d425ddc43ee06cfdd53f17bdbff929add868e8675aa2

Analysis

max time kernel
148s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 09:40

Target

36ca1a526f132bf027e5d425ddc43ee06cfdd53f17bdbff929add868e8675aa2.dll
Size

899KB
MD5

305223a38c5715fd53383fd3660a51d1
SHA1

df198d7ce15140d8a434981e29d821bb6a1fed1e
SHA256

36ca1a526f132bf027e5d425ddc43ee06cfdd53f17bdbff929add868e8675aa2
SHA512

ef6993e6c64e0d8b95415816532c754897bcc578cf33bab4640bdaa9877d81902258b93d6445f9fa7667ac5fa0757f595d7f19dd28605123231952271a3fb3ed
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXd:7wqd87Vd

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4924	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4924	3288	rundll32.exe	85
PID 3288 wrote to memory of 4924	3288	rundll32.exe	85
PID 3288 wrote to memory of 4924	3288	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36ca1a526f132bf027e5d425ddc43ee06cfdd53f17bdbff929add868e8675aa2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36ca1a526f132bf027e5d425ddc43ee06cfdd53f17bdbff929add868e8675aa2.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4924