8c67048bb0092603404af9eb282ef674aeec187c0dd37c9e0f03854a353e88d9

Analysis

max time kernel
150s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:42

Target

8c67048bb0092603404af9eb282ef674aeec187c0dd37c9e0f03854a353e88d9.dll
Size

51KB
MD5

a5a403c4108e66a724d961739db96dc0
SHA1

5e6cbede3be9df13132e1afe7f2bb1d3c31f286e
SHA256

8c67048bb0092603404af9eb282ef674aeec187c0dd37c9e0f03854a353e88d9
SHA512

00d69ea1f0429e0619922e639d10b96deea96dbd4531b642f86c038ac29d1ad4be6508e14c14807f95625b8de43f3c9d51f63150fe45c4918d0f91398e751bc1
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLHJYH5:1dWubF3n9S91BF3fboTJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
216	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 216	4356	rundll32.exe	90
PID 4356 wrote to memory of 216	4356	rundll32.exe	90
PID 4356 wrote to memory of 216	4356	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c67048bb0092603404af9eb282ef674aeec187c0dd37c9e0f03854a353e88d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c67048bb0092603404af9eb282ef674aeec187c0dd37c9e0f03854a353e88d9.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:216