d2ddb206cc91e227d303a5447d024b8e55788fdda637ff89b26e68ca33c82c57

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 05:00

Target
d2ddb206cc91e227d303a5447d024b8e55788fdda637ff89b26e68ca33c82c57.dll
Size 899KB
Sample231229-fm7n7sffe4
SHA256 d2ddb206cc91e227d303a5447d024b8e55788fdda637ff89b26e68ca33c82c57
MD5 291e5b57bc67104ed0dd7c8366562255
SHA1 46b774e7cfe2063520846295bdecf0a72107a5d9
SHA512 0ae1eaecfe22d9057cafe80f1bd9ecd64e7a04ea1141344f7cc4e91512ba7c225c94144812d602acbc5730da967a25c14b1e4a914e059e473e03a699afb51620
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXI:7wqd87VI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3660	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3660	4988	rundll32.exe	17
PID 4988 wrote to memory of 3660	4988	rundll32.exe	17
PID 4988 wrote to memory of 3660	4988	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2ddb206cc91e227d303a5447d024b8e55788fdda637ff89b26e68ca33c82c57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2ddb206cc91e227d303a5447d024b8e55788fdda637ff89b26e68ca33c82c57.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3660