8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 02:45

Target
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll
Size 50KB
Sample240423-c8xvcaca8t
SHA256 8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b
MD5 596c4ea5b387d341f53aefe4562c077d
SHA1 4102646f4ce4c80748d8dd3fb043d03a80cfd342
SHA512 7dc2c94c7436b0111097cb7972386b34da1b3ada49757a3c150e7224ed7446b8c62b45baaa42994a1f8b6844be9acbe0e1ce42693c07a1c2d1f7622a96d3affa
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5aJYH:W5ReWjTrW9rNPgYoYJYH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3716	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3716	2588	rundll32.exe	86
PID 2588 wrote to memory of 3716	2588	rundll32.exe	86
PID 2588 wrote to memory of 3716	2588	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3716