f12cc86e53c110831a729db2648a41a6dad42a03b2d7dddefcec2d84a1f47072

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2023, 02:32

Target

f12cc86e53c110831a729db2648a41a6dad42a03b2d7dddefcec2d84a1f47072.dll
Size

51KB
MD5

cfbbfa914e5f8b6a6a7a8ac466780d0d
SHA1

522b3b7d867261d2b67288ab7b06f0757a279b48
SHA256

f12cc86e53c110831a729db2648a41a6dad42a03b2d7dddefcec2d84a1f47072
SHA512

3fdd8f5e3479e1fa0081d7322c40e64bf00756692fc14f6ef91507b39470300c470d8299669b0147e7e0c487e05aaa5fe0a3f78431eb8afc2b8ac9516d69ed4a
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLrJYH5:1dWubF3n9S91BF3fbofJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5012	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 5012	2228	rundll32.exe	85
PID 2228 wrote to memory of 5012	2228	rundll32.exe	85
PID 2228 wrote to memory of 5012	2228	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f12cc86e53c110831a729db2648a41a6dad42a03b2d7dddefcec2d84a1f47072.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f12cc86e53c110831a729db2648a41a6dad42a03b2d7dddefcec2d84a1f47072.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5012