68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce

Analysis

max time kernel
134s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 06:12

Target

68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce.dll
Size

51KB
MD5

ca70ace257565de62e8d7168d46d3d12
SHA1

193762dc94deb1a6257167540ea718114c698576
SHA256

68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce
SHA512

c4fbdf96e9a8fd9fed66f6368db8b45f34a453f5b391d027ddacaca1572d8d02c3159d955201693150cf44fe6d48fc85bcfa5c6f5278d95fe6d9407bb3d24861
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboZJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
872	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 872	2968	rundll32.exe	83
PID 2968 wrote to memory of 872	2968	rundll32.exe	83
PID 2968 wrote to memory of 872	2968	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68ebc80d05b2e4394e6bebcb0de0910a9f6160ff1494c65baf65435aee9681ce.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:872