c8f5ca7f0c01ce9d967a6895d13402e2299fc62e8b94dee27b20e66f13cb1f4c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:02

Target

c8f5ca7f0c01ce9d967a6895d13402e2299fc62e8b94dee27b20e66f13cb1f4c.dll
Size

396KB
MD5

c1cd8f640dc560e9bdc873282298623e
SHA1

f1e318c4250ac14ab49efdeea7856f949d68aa1e
SHA256

c8f5ca7f0c01ce9d967a6895d13402e2299fc62e8b94dee27b20e66f13cb1f4c
SHA512

c991a75199821430cf0a83cba87323dc8e8151d5147cad5bda7ac12259dcbf75320721fc84ed7bb9ccf5128dbdefa235ed1d768311436216aae55595cf121fb1
SSDEEP

1536:/CwxSsJ5ucqow+cdl4ScsWjcdIjVuyjCgAV:/CwxSkvGl1IjVuyOgAV

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2292 rundll32.exe
2292 rundll32.exe

pid	process
2292	rundll32.exe
2292	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1800 wrote to memory of 2292	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2292	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 2292	1800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8f5ca7f0c01ce9d967a6895d13402e2299fc62e8b94dee27b20e66f13cb1f4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8f5ca7f0c01ce9d967a6895d13402e2299fc62e8b94dee27b20e66f13cb1f4c.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292