dfce3f35a61b2061becc5e4220751756dd41716cf84d70714a3363dbf7cc00ed

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 23:01

Target

dfce3f35a61b2061becc5e4220751756dd41716cf84d70714a3363dbf7cc00ed.dll
Size

51KB
MD5

20041261d57b2e998ef099fcf4b0d425
SHA1

9c71724de63aac9613c42d1875463e67fc618cd7
SHA256

dfce3f35a61b2061becc5e4220751756dd41716cf84d70714a3363dbf7cc00ed
SHA512

ed8c414b23ef98717c846d9353f91a70e837186742a53e44fd301e23e1ef069c22873ebd445596e24c5f0d4f79ecd1c1bd18a5c7bf2a3f5e8e8c169df89cf06f
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLxJYH5:1dWubF3n9S91BF3fbo9JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2132	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 2132	660	rundll32.exe	85
PID 660 wrote to memory of 2132	660	rundll32.exe	85
PID 660 wrote to memory of 2132	660	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfce3f35a61b2061becc5e4220751756dd41716cf84d70714a3363dbf7cc00ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfce3f35a61b2061becc5e4220751756dd41716cf84d70714a3363dbf7cc00ed.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2132