0d6ffa329f51523c6aaa28fbf13b0ef60f62cfb3829cc21043c6169c47bc19e9

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2023, 01:13

Target

0d6ffa329f51523c6aaa28fbf13b0ef60f62cfb3829cc21043c6169c47bc19e9.dll
Size

51KB
MD5

d1692b5e656f4c48edf90b03f740a7bf
SHA1

6fac251ac632b976710b5568a5d29f9f124e3981
SHA256

0d6ffa329f51523c6aaa28fbf13b0ef60f62cfb3829cc21043c6169c47bc19e9
SHA512

db940403ffe3c57fafec56df4543c99ca6834abd62b0b70c59cdb19baf830b6613f7264232453dcaf5c8592907abf667c66bc9faa544d84ff94f36b1957a928c
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLmJYH5:1dWubF3n9S91BF3fbo6JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4248	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4248	4924	rundll32.exe	86
PID 4924 wrote to memory of 4248	4924	rundll32.exe	86
PID 4924 wrote to memory of 4248	4924	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6ffa329f51523c6aaa28fbf13b0ef60f62cfb3829cc21043c6169c47bc19e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6ffa329f51523c6aaa28fbf13b0ef60f62cfb3829cc21043c6169c47bc19e9.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4248