db44e2cd60e3791916e5ce9c4c5a15880811c52e2ef778061b076fceb7a93d19

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 03:58

Target
db44e2cd60e3791916e5ce9c4c5a15880811c52e2ef778061b076fceb7a93d19.dll
Size 899KB
Sample240422-ejhp8sfe2y
SHA256 db44e2cd60e3791916e5ce9c4c5a15880811c52e2ef778061b076fceb7a93d19
MD5 0ec4cb8309053da4c224db557f0c0683
SHA1 10a4fa0983486783a20410da2b593c69fecdef36
SHA512 86c66c719d0e6b7d802b4262ffa57724be80ac3defb638985f474f8c55620f653ae8509f48e82940d1ae461bb2730f616fd12cc31aa943ed783162038c6cc5ef
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX4:7wqd87V4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 5100	388	rundll32.exe	85
PID 388 wrote to memory of 5100	388	rundll32.exe	85
PID 388 wrote to memory of 5100	388	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db44e2cd60e3791916e5ce9c4c5a15880811c52e2ef778061b076fceb7a93d19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db44e2cd60e3791916e5ce9c4c5a15880811c52e2ef778061b076fceb7a93d19.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5100