f90ff5cdc660eb946cebce539e132917b22bfa5e953e7992744dd145dd1ec2ab

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 05:40

Target

f90ff5cdc660eb946cebce539e132917b22bfa5e953e7992744dd145dd1ec2ab.dll
Size

51KB
MD5

0490399d64763c126b8d7e1e86e1b5be
SHA1

e8a232417d181bece1f8e305bc7c8b301864002b
SHA256

f90ff5cdc660eb946cebce539e132917b22bfa5e953e7992744dd145dd1ec2ab
SHA512

68a3e431a07128b25038f1a216def601b80b2a471d430eaaa928392726b2f63abae432d93778d663a0948c7d05abf0405828ee97a49172469a114563692dce2f
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLSJYH5:1dWubF3n9S91BF3fbo2JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1792	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 1792	512	rundll32.exe	85
PID 512 wrote to memory of 1792	512	rundll32.exe	85
PID 512 wrote to memory of 1792	512	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f90ff5cdc660eb946cebce539e132917b22bfa5e953e7992744dd145dd1ec2ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f90ff5cdc660eb946cebce539e132917b22bfa5e953e7992744dd145dd1ec2ab.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1792