fb68fb47df495db97cd732126da6d2329a56a4b9ce5db86de42acb166fe27969

Analysis

max time kernel
144s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 19:23

Target

fb68fb47df495db97cd732126da6d2329a56a4b9ce5db86de42acb166fe27969.dll
Size

899KB
MD5

f048eaf99bb62a161887a76d3b007fa0
SHA1

07eab95dc4d83e01a7a2dd5ebbdc31e4a7618e41
SHA256

fb68fb47df495db97cd732126da6d2329a56a4b9ce5db86de42acb166fe27969
SHA512

26d69843fe422def7548c2f53c5dc480dde62a4bfdcc64affddbaff2e427e6195748873bef41ccc542fbeb334b8a10e58eb45c8c29f62a4a8c29a97c9aea7bee
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXi:7wqd87Vi

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1048	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1048	3032	rundll32.exe	68
PID 3032 wrote to memory of 1048	3032	rundll32.exe	68
PID 3032 wrote to memory of 1048	3032	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb68fb47df495db97cd732126da6d2329a56a4b9ce5db86de42acb166fe27969.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb68fb47df495db97cd732126da6d2329a56a4b9ce5db86de42acb166fe27969.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1048