fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 08:55

Target

fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d.dll
Size

50KB
MD5

15351c797f2c7c257e76d18f52359983
SHA1

e45c2acc28be9b3a15fdc132e6374a9206fee5b0
SHA256

fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d
SHA512

63c0870d02427a14b5371eb65819ea62cc36991ed4e001b2ba406765ed7ecc25c243d68bee39991af1c3c1d38e339fcefcf71bcc59b3a67e285fbdccedbfb877
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5EJYH:W5ReWjTrW9rNPgYoyJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
868	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:868