7afaa33cb25c3f2a97c224f44a163c3d0f4454cf1b837845a617d008249be3ab

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 02:53

Target
7afaa33cb25c3f2a97c224f44a163c3d0f4454cf1b837845a617d008249be3ab.dll
Size 899KB
Sample240423-ddhydaca36
SHA256 7afaa33cb25c3f2a97c224f44a163c3d0f4454cf1b837845a617d008249be3ab
MD5 e0d1bb19215ba4cadaa753848b85ed0e
SHA1 902ebd8519511d63c6518e3d2c6950659f909db0
SHA512 171ff2923e6cc1da0d8e62420e2ceb5c84d6077c504273368bfa494b04961ef48a8a05846d0fcbbd87ee35c29532f76710c117d1877781384399aef134179ec9
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXh:7wqd87Vh
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4452	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4452	3600	rundll32.exe	86
PID 3600 wrote to memory of 4452	3600	rundll32.exe	86
PID 3600 wrote to memory of 4452	3600	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7afaa33cb25c3f2a97c224f44a163c3d0f4454cf1b837845a617d008249be3ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7afaa33cb25c3f2a97c224f44a163c3d0f4454cf1b837845a617d008249be3ab.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4452