253c49af2bdba93a34b8e8dd7ceec624dc15e630325e556571e25dd635f125e7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 11:14

Target
253c49af2bdba93a34b8e8dd7ceec624dc15e630325e556571e25dd635f125e7.dll
Size 50KB
Sample240421-nb82wsaa2v
SHA256 253c49af2bdba93a34b8e8dd7ceec624dc15e630325e556571e25dd635f125e7
MD5 09ab8eb521055c57f5aab1d3b3fc6ba4
SHA1 9a20cab7f7d83245ee20d03a4fd642b419710fdc
SHA512 b126a6653a4d5ff0d51db9720ad6f420343bd5594a8c981cec46415a306fa8da13d318eac5da6ef6c0879c7b7961fd2800746bf44238e54912917aea9e409041
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5MJYH:W5ReWjTrW9rNPgYoCJYH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
448	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 448	4244	rundll32.exe	85
PID 4244 wrote to memory of 448	4244	rundll32.exe	85
PID 4244 wrote to memory of 448	4244	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\253c49af2bdba93a34b8e8dd7ceec624dc15e630325e556571e25dd635f125e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\253c49af2bdba93a34b8e8dd7ceec624dc15e630325e556571e25dd635f125e7.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:448