d5f5a87385c9ff0b4d9dcf5a35eb14802e019f6c1ef808923b03e30333a60ff4

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 03:32

Target
d5f5a87385c9ff0b4d9dcf5a35eb14802e019f6c1ef808923b03e30333a60ff4.dll
Size 51KB
Sample240423-d3tfeace3z
SHA256 d5f5a87385c9ff0b4d9dcf5a35eb14802e019f6c1ef808923b03e30333a60ff4
MD5 936f1b4fbd1d9fdb632b01f67b7327a8
SHA1 24093855715785b98d57d8c3605d23101e65cd3e
SHA512 d184288a7b0c051e3a8bbd0c5ea1d2f0fe4eb0ca094123cec7dbaf991caaf2f2991e1662d3f44c7e1fd6036dc8ce9fa6e57f45b6604643b52fc8d500bc31b42d
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLEJYH5:1dWubF3n9S91BF3fbowJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3512	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 3512	1440	rundll32.exe	85
PID 1440 wrote to memory of 3512	1440	rundll32.exe	85
PID 1440 wrote to memory of 3512	1440	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5f5a87385c9ff0b4d9dcf5a35eb14802e019f6c1ef808923b03e30333a60ff4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5f5a87385c9ff0b4d9dcf5a35eb14802e019f6c1ef808923b03e30333a60ff4.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3512