48c30286de205646d2f95e341f916dac89c92016b96b1b0bc362f8bbc556f58f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 02:14

Target
48c30286de205646d2f95e341f916dac89c92016b96b1b0bc362f8bbc556f58f.dll
Size 51KB
Sample240423-cpbsrsbe57
SHA256 48c30286de205646d2f95e341f916dac89c92016b96b1b0bc362f8bbc556f58f
MD5 adf3074716bf41889b7c34858c822a67
SHA1 80c21418af6f685ab57c5d1aed2a9b9a2f1d0508
SHA512 602edac9de217f7a42156cec7f1b172dfb427f16c6766d109c25a60da70487dc6470983753d462352fe1f1c5f0998651f0706951baab7e9e121d1b43238bac10
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLrJYH5:1dWubF3n9S91BF3fboXJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
868	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 868	3172	rundll32.exe	85
PID 3172 wrote to memory of 868	3172	rundll32.exe	85
PID 3172 wrote to memory of 868	3172	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c30286de205646d2f95e341f916dac89c92016b96b1b0bc362f8bbc556f58f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c30286de205646d2f95e341f916dac89c92016b96b1b0bc362f8bbc556f58f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:868