5c5a90b6fa26f414323af0aecc00515b13c2041c3491f17a26c87f9c923180de

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 22:27

Target
5c5a90b6fa26f414323af0aecc00515b13c2041c3491f17a26c87f9c923180de.dll
Size 51KB
Sample240422-2c4qfshb59
SHA256 5c5a90b6fa26f414323af0aecc00515b13c2041c3491f17a26c87f9c923180de
MD5 921803ed2d3bb28bfab241caa64b9fa1
SHA1 2459fd113fbb96191dbbc22169ec4a06c04d1b69
SHA512 e349503b7c2a139dff88b82fb0005df8cd8d7466c96a9622ff913cd412f1cfb307fdd8f7d9ce1ccc7741cb5b89e4a69abaf524640d04eba823f72761bf00ca52
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLjJYH5:1dWubF3n9S91BF3fboXJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2168	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2168	2556	rundll32.exe	81
PID 2556 wrote to memory of 2168	2556	rundll32.exe	81
PID 2556 wrote to memory of 2168	2556	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c5a90b6fa26f414323af0aecc00515b13c2041c3491f17a26c87f9c923180de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c5a90b6fa26f414323af0aecc00515b13c2041c3491f17a26c87f9c923180de.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2168