f44ef920fb431d0ff6b7e78a0c899a097b174da7a42bd6dc3c6dcc0fe10d53a8

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 09:32

Target

f44ef920fb431d0ff6b7e78a0c899a097b174da7a42bd6dc3c6dcc0fe10d53a8.dll
Size

50KB
MD5

d53b408d6b9ee16264767b7e06049e1b
SHA1

9aecb05e84e7419d64a4d042b3d7de9eb94b2571
SHA256

f44ef920fb431d0ff6b7e78a0c899a097b174da7a42bd6dc3c6dcc0fe10d53a8
SHA512

fe71d29daa996141459f07becc6e0e68079bb3e08a4f02dad8fc278caeda9f9ec792aa26ca6c8d214e21a0e54e6f36870b9593889aa74b2effa8445a0ee115e0
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5XJYH:W5ReWjTrW9rNPgYoxJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2156	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2156	4884	rundll32.exe	83
PID 4884 wrote to memory of 2156	4884	rundll32.exe	83
PID 4884 wrote to memory of 2156	4884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f44ef920fb431d0ff6b7e78a0c899a097b174da7a42bd6dc3c6dcc0fe10d53a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f44ef920fb431d0ff6b7e78a0c899a097b174da7a42bd6dc3c6dcc0fe10d53a8.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2156