d7e16c840f0aaaa16029732bb02936db4c0f9bd1fd66a266001bf39ebf53e8bd

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 13:43

Target

d7e16c840f0aaaa16029732bb02936db4c0f9bd1fd66a266001bf39ebf53e8bd.dll
Size

51KB
MD5

f1b2e3bc5a24e87d63cd3d1ef8365840
SHA1

c6fdfd2e58a4ae951401367c4df9e2165c61d00d
SHA256

d7e16c840f0aaaa16029732bb02936db4c0f9bd1fd66a266001bf39ebf53e8bd
SHA512

859d71149e46a9fd40faa137b08fea62469fe18ed4b1de044fd7fe279d7ccc6ddc9e617cd1520c5c3ec087fb2945a2b5c56faa1f09f7b870a465deef14c28db9
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLIJYH5:1dWubF3n9S91BF3fboEJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
116	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 116	4624	rundll32.exe	87
PID 4624 wrote to memory of 116	4624	rundll32.exe	87
PID 4624 wrote to memory of 116	4624	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7e16c840f0aaaa16029732bb02936db4c0f9bd1fd66a266001bf39ebf53e8bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7e16c840f0aaaa16029732bb02936db4c0f9bd1fd66a266001bf39ebf53e8bd.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:116