fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2023 23:33

Target

fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da.dll
Size

51KB
MD5

440ce24db2465a9eae357bedba916941
SHA1

1c49b2ccd9ed86ad7c387f120b0202bbcd7ee8c8
SHA256

fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da
SHA512

368a478ca9d9ac790079c5c88b7f491fc4baaabf92a432152dac7ecd9e48b44cc8aa9e5f8f2927af6cdc9c5fc7115b328cb4d6b834610c8d2917daf69f8d1714
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL6JYH5:1dWubF3n9S91BF3fboOJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 228	3996	rundll32.exe	80
PID 3996 wrote to memory of 228	3996	rundll32.exe	80
PID 3996 wrote to memory of 228	3996	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa091f7ddda6d2e5f3a33b6428b101c2dd3462f5fafd017374903a27416fd2da.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:228