ef4dd134ef07b91dabc585b6174ad6641d5d4e0aa09140c15a0d2373791b63b3

Analysis

max time kernel
134s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:56

Target

ef4dd134ef07b91dabc585b6174ad6641d5d4e0aa09140c15a0d2373791b63b3.dll
Size

51KB
MD5

deca711b2653ee73e1ec4ab005bb0cc8
SHA1

0ba2f29ad1e1568ec057ad65a4c0260d5bffe63e
SHA256

ef4dd134ef07b91dabc585b6174ad6641d5d4e0aa09140c15a0d2373791b63b3
SHA512

e167d5781a54185b3d2cb04cc024f7a29fde52974d7988b1c43a1a8ea4685cb10be37fb60553d3d6bcf5abff43a761d5d30c5d1dfef6a963ddc27a5b91e823c7
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL4JYH5:1dWubF3n9S91BF3fboEJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2748	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2748	1236	rundll32.exe	80
PID 1236 wrote to memory of 2748	1236	rundll32.exe	80
PID 1236 wrote to memory of 2748	1236	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef4dd134ef07b91dabc585b6174ad6641d5d4e0aa09140c15a0d2373791b63b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef4dd134ef07b91dabc585b6174ad6641d5d4e0aa09140c15a0d2373791b63b3.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2748