365cc5e68a9bc20c3a1663d6a7ee5f4b42dc73d98ccc0e7c8c65a20fbc358099

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 11:14

Target
365cc5e68a9bc20c3a1663d6a7ee5f4b42dc73d98ccc0e7c8c65a20fbc358099.dll
Size 51KB
Sample240423-nb9cnaff69
SHA256 365cc5e68a9bc20c3a1663d6a7ee5f4b42dc73d98ccc0e7c8c65a20fbc358099
MD5 7a39c9a4de1b571abdbe3482b990c107
SHA1 8478f926b84ba231172319c58d0a203484b1ea79
SHA512 bb3ab90c68572d05904b8c018af1b43105f5c733ea216cc08e96c11926f426c3514b0415403a96f6985ee28caf7e2dc60935fe1894218ae10a8083522e08b554
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL7JYH5:1dWubF3n9S91BF3fboHJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2452	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2452	1740	rundll32.exe	86
PID 1740 wrote to memory of 2452	1740	rundll32.exe	86
PID 1740 wrote to memory of 2452	1740	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\365cc5e68a9bc20c3a1663d6a7ee5f4b42dc73d98ccc0e7c8c65a20fbc358099.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\365cc5e68a9bc20c3a1663d6a7ee5f4b42dc73d98ccc0e7c8c65a20fbc358099.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2452