7efbcf98c04674d56f3d1950f7a65c4809c5eb5087e4dd0b929f987916afd18e

Analysis

max time kernel
134s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 00:52

Target

7efbcf98c04674d56f3d1950f7a65c4809c5eb5087e4dd0b929f987916afd18e.dll
Size

50KB
MD5

a9e87e50c5265bded790c29858c12e9a
SHA1

9deb918d330dc55258d045ac8df80b5ded76c09f
SHA256

7efbcf98c04674d56f3d1950f7a65c4809c5eb5087e4dd0b929f987916afd18e
SHA512

c1053ad2d533ec760a3c2dbaf960dfe8f228c2cc6d8f531cddf74ffdbf03280df4af90e196c8d45578620da70847b44622808b3aca936866fc3f04ffa8c7a478
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o58JYH:W5ReWjTrW9rNPgYoGJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1496	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 1496	4140	rundll32.exe	82
PID 4140 wrote to memory of 1496	4140	rundll32.exe	82
PID 4140 wrote to memory of 1496	4140	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7efbcf98c04674d56f3d1950f7a65c4809c5eb5087e4dd0b929f987916afd18e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7efbcf98c04674d56f3d1950f7a65c4809c5eb5087e4dd0b929f987916afd18e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1496