d83b1bf0ec249604f2b128a9c9004b95c1368734487b52c7d1774d9a4cef3e6d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 10:20

Target

d83b1bf0ec249604f2b128a9c9004b95c1368734487b52c7d1774d9a4cef3e6d.dll
Size

51KB
MD5

fda3dff2a57e8a605bf8b0119c26b45f
SHA1

8cb1bda9742a56e1d3fca7047671dcb1bb7adfcb
SHA256

d83b1bf0ec249604f2b128a9c9004b95c1368734487b52c7d1774d9a4cef3e6d
SHA512

937a1b6585dfd340542564596595f9f140312611ad30e505924e2a9dd74640ae5dda171433698b85bad8722b2cae17bccc487193b785ef7732085e30011fae40
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezWsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBJpMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4260	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4260	1408	rundll32.exe	84
PID 1408 wrote to memory of 4260	1408	rundll32.exe	84
PID 1408 wrote to memory of 4260	1408	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d83b1bf0ec249604f2b128a9c9004b95c1368734487b52c7d1774d9a4cef3e6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d83b1bf0ec249604f2b128a9c9004b95c1368734487b52c7d1774d9a4cef3e6d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4260

memory/4260-0-0x0000000075880000-0x0000000075890000-memory.dmp

Filesize
64KB

Download