fbcc8c4a7e94681e21c3665692d49d37e200021d9fcb2cb2f9cbf6971718f547

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 20:48

Target

fbcc8c4a7e94681e21c3665692d49d37e200021d9fcb2cb2f9cbf6971718f547.dll
Size

50KB
MD5

53889137eac2dca3be81f3c6876f0c7e
SHA1

47a80e0c0626fd08f8101f77265c8394983f58b3
SHA256

fbcc8c4a7e94681e21c3665692d49d37e200021d9fcb2cb2f9cbf6971718f547
SHA512

e23c797f6521cea940e44160572d307bddc65c33631ab62791539cc5d9ff5809d4350a1838e879bbd0859156a9f936f74d44b1f30344192f4f151cd6f191e1d2
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5KJYH:W5ReWjTrW9rNPgYokJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1464	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 1464	116	rundll32.exe	88
PID 116 wrote to memory of 1464	116	rundll32.exe	88
PID 116 wrote to memory of 1464	116	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbcc8c4a7e94681e21c3665692d49d37e200021d9fcb2cb2f9cbf6971718f547.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbcc8c4a7e94681e21c3665692d49d37e200021d9fcb2cb2f9cbf6971718f547.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1464