eafba7cbe87b2c4a122f6d5367b760f1d0c4346e5d684df1d37c687b04cbee7b

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2023, 09:24

Target
eafba7cbe87b2c4a122f6d5367b760f1d0c4346e5d684df1d37c687b04cbee7b.dll
Size 899KB
Sample231125-lddyesad6w
SHA256 eafba7cbe87b2c4a122f6d5367b760f1d0c4346e5d684df1d37c687b04cbee7b
MD5 9982d24f7b44ae46795a9b1a50f65d51
SHA1 c10865dd63c862dca167097e049bb42d9fbeaeee
SHA512 fe7cc9501379c2585ca04cca1285abeedea83981440dd0ae725007f81422815659e708c419bd880926d8b41ba0bd8609d2a1c5b2d55d6a6e367c6752d301ecf8
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXh:7wqd87Vh
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3156	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 3156	3532	rundll32.exe	83
PID 3532 wrote to memory of 3156	3532	rundll32.exe	83
PID 3532 wrote to memory of 3156	3532	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eafba7cbe87b2c4a122f6d5367b760f1d0c4346e5d684df1d37c687b04cbee7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eafba7cbe87b2c4a122f6d5367b760f1d0c4346e5d684df1d37c687b04cbee7b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3156