4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485

Analysis

max time kernel
140s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 10:19

Target

4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485.dll
Size

51KB
MD5

4ad5d829afbe5c7f8c8b83edf359185d
SHA1

9982fed1ebfdeca59a422f8ad7a9cbdaac4bafcb
SHA256

4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485
SHA512

daa37dd70fc21fb76a9c458928b8da2441e03611ea193ad73e245b451751f221de0c0664c70f5498ccaa76a8519b1c137995ec28a169d72af6a4054af8c9d140
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezqsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBtpMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4524	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 4524	1032	rundll32.exe	83
PID 1032 wrote to memory of 4524	1032	rundll32.exe	83
PID 1032 wrote to memory of 4524	1032	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3252d672737caab5ea2bf0866abd5155884b8777dd2e20dd6a969be1564485.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4524

memory/4524-0-0x0000000074C30000-0x0000000074C40000-memory.dmp

Filesize
64KB

Download