3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 14:42

Target

3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820.dll
Size

51KB
MD5

7e892987aac19905335f99c878ca0345
SHA1

4d532473a2341c22de7de320d5457b0992f35772
SHA256

3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820
SHA512

9350fceeb847e45e7c62b19ef298ae885b3045d79709c1e311c2afdd95b8629f8422d9bfab4a6db1700edf51fb7928434f77efa20d5b58a745a20639abe87ee0
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezVsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBOpMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3316	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3316	2604	rundll32.exe	81
PID 2604 wrote to memory of 3316	2604	rundll32.exe	81
PID 2604 wrote to memory of 3316	2604	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b7469b006d9a3a7a429951cf41b02bd4d3ffa736bf35a8fe5ccda3cbadb6820.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3316

memory/3316-0-0x0000000075910000-0x0000000075920000-memory.dmp

Filesize
64KB

Download