6390d7cc3102a48e9b11e38b25dfeb147316bbfe9734544211d5af8f4891fb26

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 11:19

Target

6390d7cc3102a48e9b11e38b25dfeb147316bbfe9734544211d5af8f4891fb26.dll
Size

51KB
MD5

36e40b64542fe2c92e62cdb403cac8ae
SHA1

d866c769ab3abe57456dd18cd199f87cbb5b5b61
SHA256

6390d7cc3102a48e9b11e38b25dfeb147316bbfe9734544211d5af8f4891fb26
SHA512

410ba5c2f7a6bbe9b8b16e191f4c5d1733ea023169e47241794c79c734948f7ed4491ea6ddbd564d8e101175ee2649892ba92ac050248e31f6fa0fc4d3297050
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLVJYH5:1dWubF3n9S91BF3fboJJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3040	2988	rundll32.exe	84
PID 2988 wrote to memory of 3040	2988	rundll32.exe	84
PID 2988 wrote to memory of 3040	2988	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6390d7cc3102a48e9b11e38b25dfeb147316bbfe9734544211d5af8f4891fb26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6390d7cc3102a48e9b11e38b25dfeb147316bbfe9734544211d5af8f4891fb26.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3040