93cb3aa6dfc2a1cf1b6bd318a2b747cfa0db5bbe2fcc14430167486e23ca894d

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 09:17

Target
93cb3aa6dfc2a1cf1b6bd318a2b747cfa0db5bbe2fcc14430167486e23ca894d.dll
Size 899KB
Sample240426-k8233add44
SHA256 93cb3aa6dfc2a1cf1b6bd318a2b747cfa0db5bbe2fcc14430167486e23ca894d
MD5 740559e499fbd26e0d62891cb425ba86
SHA1 b85b84372d4d8310eccaf86e7c3c397f9466ae72
SHA512 40f1067eb9bf3c0047f39ff9880064c2f51e6d6c51648c571a5472ebb9887d05e2de04457668f9d636060619b4683a8b920628cacd06f7c5527875668c2ff749
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXp:7wqd87Vp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2632	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2632	4368	rundll32.exe	88
PID 4368 wrote to memory of 2632	4368	rundll32.exe	88
PID 4368 wrote to memory of 2632	4368	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93cb3aa6dfc2a1cf1b6bd318a2b747cfa0db5bbe2fcc14430167486e23ca894d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93cb3aa6dfc2a1cf1b6bd318a2b747cfa0db5bbe2fcc14430167486e23ca894d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2632