0bfcb736f8a1a55f5da3bb2654eb87b7c060ee957929c162e3d438c2cdf55109

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:28

Target

0bfcb736f8a1a55f5da3bb2654eb87b7c060ee957929c162e3d438c2cdf55109.dll
Size

899KB
MD5

ac6ff64ba7a8d220f7a6bdfda240d5db
SHA1

6c0e36aa9e665b2daaea1e82d29410c15d9dc8bd
SHA256

0bfcb736f8a1a55f5da3bb2654eb87b7c060ee957929c162e3d438c2cdf55109
SHA512

67a35e1f48e9ff7b84cc2fcfa07b46fa770630d5e0046cac73165dc0956852427ca97304417d46a594d2c8597a0fbbf97d5a9e28575dcb24b181350a567dd2b6
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXM:7wqd87VM

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1116	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1116	4064	rundll32.exe	82
PID 4064 wrote to memory of 1116	4064	rundll32.exe	82
PID 4064 wrote to memory of 1116	4064	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bfcb736f8a1a55f5da3bb2654eb87b7c060ee957929c162e3d438c2cdf55109.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bfcb736f8a1a55f5da3bb2654eb87b7c060ee957929c162e3d438c2cdf55109.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1116