a974428d1062aac17ff6b901bd4a617ee1c939b37fd06f6f13a397010553ac24

Analysis

max time kernel
134s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 10:39

Target

a974428d1062aac17ff6b901bd4a617ee1c939b37fd06f6f13a397010553ac24.dll
Size

50KB
MD5

065917570144b4b627588b96991e1260
SHA1

70c71add9737f6b74a2e40769c72f93e5b61f281
SHA256

a974428d1062aac17ff6b901bd4a617ee1c939b37fd06f6f13a397010553ac24
SHA512

d2dcca0cbec237e0bbeb7a1e1aec201f261eb125e05a4060289c429672435292c6cd6d65c8b6693ba8fe11be4207b157f8ae4ba1f78d3f89313ff5fcde667454
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o59JYH:W5ReWjTrW9rNPgYoLJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2472	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2472	2028	rundll32.exe	88
PID 2028 wrote to memory of 2472	2028	rundll32.exe	88
PID 2028 wrote to memory of 2472	2028	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a974428d1062aac17ff6b901bd4a617ee1c939b37fd06f6f13a397010553ac24.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a974428d1062aac17ff6b901bd4a617ee1c939b37fd06f6f13a397010553ac24.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2472