8de70348afcd689b4dd3d409cf70115bcff40312a651d7781cc37e5f5bf25c8a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 12:14

Target
8de70348afcd689b4dd3d409cf70115bcff40312a651d7781cc37e5f5bf25c8a.dll
Size 51KB
Sample240423-pergpaga5y
SHA256 8de70348afcd689b4dd3d409cf70115bcff40312a651d7781cc37e5f5bf25c8a
MD5 ed8c10201486080bf4b850b9fcfab497
SHA1 ea7de4fd657ada510d418a792bbc7ee06fcf29c7
SHA512 62cb57b2af459056215046cd15f943c133a706c342161a63ea8143af0a7e3ae6201b4df2166ebee01c4bfc63136a4aa75f7acc7bb3d38f305873fcb1a318a8c7
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLsJYH5:1dWubF3n9S91BF3fbooJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1092	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1092	1800	rundll32.exe	81
PID 1800 wrote to memory of 1092	1800	rundll32.exe	81
PID 1800 wrote to memory of 1092	1800	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8de70348afcd689b4dd3d409cf70115bcff40312a651d7781cc37e5f5bf25c8a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8de70348afcd689b4dd3d409cf70115bcff40312a651d7781cc37e5f5bf25c8a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1092