ffdb85a9454548aaf1a897584e87617f04c6e75c4b9c8eab0368775c24c356f8

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 01:26

Target

ffdb85a9454548aaf1a897584e87617f04c6e75c4b9c8eab0368775c24c356f8.dll
Size

899KB
MD5

a8c75a89b6b01c2e3176de018e09c1dd
SHA1

218c46a81020218bed48dea2bf26574b3b79ab2f
SHA256

ffdb85a9454548aaf1a897584e87617f04c6e75c4b9c8eab0368775c24c356f8
SHA512

5aae0938ccf9ebfc41f22b3a75a40c338aac036ed109e510d8def18d4b1c4fcc4898f3fc718517cb6227bcfcfc931d9a63c384be7597be2eef29da83dcf4797c
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXg:7wqd87Vg

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4676	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4676	4424	rundll32.exe	88
PID 4424 wrote to memory of 4676	4424	rundll32.exe	88
PID 4424 wrote to memory of 4676	4424	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffdb85a9454548aaf1a897584e87617f04c6e75c4b9c8eab0368775c24c356f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffdb85a9454548aaf1a897584e87617f04c6e75c4b9c8eab0368775c24c356f8.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4676