fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 08:55

Target

fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d.dll
Size

50KB
MD5

15351c797f2c7c257e76d18f52359983
SHA1

e45c2acc28be9b3a15fdc132e6374a9206fee5b0
SHA256

fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d
SHA512

63c0870d02427a14b5371eb65819ea62cc36991ed4e001b2ba406765ed7ecc25c243d68bee39991af1c3c1d38e339fcefcf71bcc59b3a67e285fbdccedbfb877
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5EJYH:W5ReWjTrW9rNPgYoyJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1472	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1472	2284	rundll32.exe	85
PID 2284 wrote to memory of 1472	2284	rundll32.exe	85
PID 2284 wrote to memory of 1472	2284	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa94bcd7940c89f9898cee8e903a54ace9c54a246da5cc1143133436356e3a8d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1472