902c8e6222173734ab37429407586383fca156408b119e2f21537be5efb8608d

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 13:59

Target

c53ca6409475f70795af6a9d7bd472a0N.dll
Size

222KB
MD5

c53ca6409475f70795af6a9d7bd472a0
SHA1

815c061b02afb79df65666d7125200b4a9afec3e
SHA256

902c8e6222173734ab37429407586383fca156408b119e2f21537be5efb8608d
SHA512

25996f1e4dcebb2c7bdbdeaefeff8bfb0fc9b8cf81da4b94ab44f9c30d6f7752b02ef9a1f8e45cb674727adf8a0cd8d4dd8c299fa98ac3ddc72beafb38063f40
SSDEEP

3072:9O3qd+oYNZGEHeL42apHC8QaBYe3RbS8DtLAx0YCmoeOihpEliI6XBJWxcHe4ir:w3C+X9HYSGy9quihpEAWK

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\PrintConfig.dll	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2020	3920	rundll32.exe	86
PID 3920 wrote to memory of 2020	3920	rundll32.exe	86
PID 3920 wrote to memory of 2020	3920	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53ca6409475f70795af6a9d7bd472a0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53ca6409475f70795af6a9d7bd472a0N.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2020

memory/2020-0-0x0000000074D3A000-0x0000000074D5D000-memory.dmp

Filesize
140KB

Download