fee6ed2aeed04dfdfefe5febf05d2d4617ed79b68f4ddb2b843688a87b67c2c7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 18:14

Target
fee6ed2aeed04dfdfefe5febf05d2d4617ed79b68f4ddb2b843688a87b67c2c7.dll
Size 899KB
Sample240422-wvs4saee2x
SHA256 fee6ed2aeed04dfdfefe5febf05d2d4617ed79b68f4ddb2b843688a87b67c2c7
MD5 e052f47cf0a62768997e7eddb982e8e7
SHA1 91a914b0df618708c10b20b0fc2fcac25dd1015f
SHA512 625a29723b4e8214a72d38c9616825913f5b409d7a4786a964c6073c2052e91db7faa9cbec3294ec62d29f45f0d85402f2ba9f1eeb765869530d08db35454cae
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXO:7wqd87VO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4776	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4776	3164	rundll32.exe	84
PID 3164 wrote to memory of 4776	3164	rundll32.exe	84
PID 3164 wrote to memory of 4776	3164	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fee6ed2aeed04dfdfefe5febf05d2d4617ed79b68f4ddb2b843688a87b67c2c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fee6ed2aeed04dfdfefe5febf05d2d4617ed79b68f4ddb2b843688a87b67c2c7.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4776