ef28916df6acb4e7806ad2e225f3bd0925bc534a513fdea53f1efbd5ea4676f1

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2023 23:14

Target

ef28916df6acb4e7806ad2e225f3bd0925bc534a513fdea53f1efbd5ea4676f1.dll
Size

899KB
MD5

191424a1575e15327591af64b5d91156
SHA1

969fff04dd4790bf467e72834b4047c5b3fa9d47
SHA256

ef28916df6acb4e7806ad2e225f3bd0925bc534a513fdea53f1efbd5ea4676f1
SHA512

11a47ef52cb01b8f7b641376a5b382cb281aee8690630a58af108b6c21a632abcd25be354d59855fc74c98c12b642cbceff1ee06472bea009a3ec7fee8d22d46
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXo:7wqd87Vo

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3032	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3032	3700	rundll32.exe	85
PID 3700 wrote to memory of 3032	3700	rundll32.exe	85
PID 3700 wrote to memory of 3032	3700	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef28916df6acb4e7806ad2e225f3bd0925bc534a513fdea53f1efbd5ea4676f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef28916df6acb4e7806ad2e225f3bd0925bc534a513fdea53f1efbd5ea4676f1.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3032