68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 06:12

Target

68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce.dll
Size

51KB
MD5

ca70ace257565de62e8d7168d46d3d12
SHA1

193762dc94deb1a6257167540ea718114c698576
SHA256

68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce
SHA512

c4fbdf96e9a8fd9fed66f6368db8b45f34a453f5b391d027ddacaca1572d8d02c3159d955201693150cf44fe6d48fc85bcfa5c6f5278d95fe6d9407bb3d24861
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboZJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2300	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2300