ace133764b89561d516bfc65972c4e99c5eb1a1fcbf50fcabbbe40d10325cceb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 10:30

Target

ace133764b89561d516bfc65972c4e99c5eb1a1fcbf50fcabbbe40d10325cceb.dll
Size

51KB
MD5

93d724836c1c014c5c92f5e222c0c842
SHA1

5d5c21fbf66f66cc866e4d35011266ba930d2764
SHA256

ace133764b89561d516bfc65972c4e99c5eb1a1fcbf50fcabbbe40d10325cceb
SHA512

b9e51419e7a92ab64f3aa9a2ab400da0e9a9d26a931e654aa0d265d02f9a775ef0a6a907df51b7d4c7d654c880246096bd3344cc2c0c3165be3aa0cf649822e6
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezWsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBJpMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1944	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1944	2052	rundll32.exe	28
PID 2052 wrote to memory of 1944	2052	rundll32.exe	28
PID 2052 wrote to memory of 1944	2052	rundll32.exe	28
PID 2052 wrote to memory of 1944	2052	rundll32.exe	28
PID 2052 wrote to memory of 1944	2052	rundll32.exe	28
PID 2052 wrote to memory of 1944	2052	rundll32.exe	28
PID 2052 wrote to memory of 1944	2052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ace133764b89561d516bfc65972c4e99c5eb1a1fcbf50fcabbbe40d10325cceb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ace133764b89561d516bfc65972c4e99c5eb1a1fcbf50fcabbbe40d10325cceb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1944