c2c22cc3bd65b6072d3bdc48b9ddc9d9a5f9ef923ed7c3c0141b0004f14f2b53

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 00:20

Target
c2c22cc3bd65b6072d3bdc48b9ddc9d9a5f9ef923ed7c3c0141b0004f14f2b53.dll
Size 51KB
Sample240423-amy46saa75
SHA256 c2c22cc3bd65b6072d3bdc48b9ddc9d9a5f9ef923ed7c3c0141b0004f14f2b53
MD5 fd9da89493c09c3c3c780b3919930aaf
SHA1 4a069914f28a617ea31460394fc16d04c0fde955
SHA512 54a5b54f62abeba5ebd7b5428fee0458cf9d0bca098470c5b21fee562d0da9a0de81d5fd9365b80c80db1cd0a4da98f2fbbb1bf5eb02d50a9d3a5e2a4de88dd9
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL/JYH5:1dWubF3n9S91BF3fbozJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4512	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4512	4468	rundll32.exe	84
PID 4468 wrote to memory of 4512	4468	rundll32.exe	84
PID 4468 wrote to memory of 4512	4468	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2c22cc3bd65b6072d3bdc48b9ddc9d9a5f9ef923ed7c3c0141b0004f14f2b53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2c22cc3bd65b6072d3bdc48b9ddc9d9a5f9ef923ed7c3c0141b0004f14f2b53.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4512