ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 15:10

Target

ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c.dll
Size

50KB
MD5

251a3ad5cf5e09fb7ae0495b1dadef46
SHA1

9806f27ee33c51b389e024eb0dfa35595303e337
SHA256

ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c
SHA512

2f178f6c8c64c5247771e765e33c513b5169571e059cd32cfc070f1cb652f129da85fe49fd52351762c44705276eac727b423f0fe8afbc778e072aa5f5085a1b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5RJYH:W5ReWjTrW9rNPgYonJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3032	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3032	432	rundll32.exe	84
PID 432 wrote to memory of 3032	432	rundll32.exe	84
PID 432 wrote to memory of 3032	432	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffeb023dc38437d54568db88ab3f8ac83859f96a3303a622496eccaca43ec91c.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3032