ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c

Analysis

max time kernel
127s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 15:10

Target

ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c.dll
Size

50KB
MD5

251a3ad5cf5e09fb7ae0495b1dadef46
SHA1

9806f27ee33c51b389e024eb0dfa35595303e337
SHA256

ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c
SHA512

2f178f6c8c64c5247771e765e33c513b5169571e059cd32cfc070f1cb652f129da85fe49fd52351762c44705276eac727b423f0fe8afbc778e072aa5f5085a1b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5RJYH:W5ReWjTrW9rNPgYonJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2960	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2960	1800	rundll32.exe	28
PID 1800 wrote to memory of 2960	1800	rundll32.exe	28
PID 1800 wrote to memory of 2960	1800	rundll32.exe	28
PID 1800 wrote to memory of 2960	1800	rundll32.exe	28
PID 1800 wrote to memory of 2960	1800	rundll32.exe	28
PID 1800 wrote to memory of 2960	1800	rundll32.exe	28
PID 1800 wrote to memory of 2960	1800	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2960