fec3ec7b0bd6356bef36527437fe37c3cb52c28f0cbbf5f3eddac9c967a772bb

Analysis

max time kernel
153s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 21:51

Target

fec3ec7b0bd6356bef36527437fe37c3cb52c28f0cbbf5f3eddac9c967a772bb.dll
Size

899KB
MD5

24016d7b00e139a88d191922d0fa5cce
SHA1

ba759f06cc49a46e9b4bbe53000240ae68a8d4e6
SHA256

fec3ec7b0bd6356bef36527437fe37c3cb52c28f0cbbf5f3eddac9c967a772bb
SHA512

4d7819ad3d79b147d7e8171ccb514c24d239ff2027d993eb4c7c1ac6f8aa198d487946118ca903c7447f1aaa46535d72edf91d0a7abb11287f935b6af197d741
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXk:7wqd87Vk

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1396	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1396	5020	rundll32.exe	86
PID 5020 wrote to memory of 1396	5020	rundll32.exe	86
PID 5020 wrote to memory of 1396	5020	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fec3ec7b0bd6356bef36527437fe37c3cb52c28f0cbbf5f3eddac9c967a772bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fec3ec7b0bd6356bef36527437fe37c3cb52c28f0cbbf5f3eddac9c967a772bb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1396