fcfa395be3fef8d2bbc4627554cc3a8310a11aae4e62fd07913542c5d0eadfee

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 08:22

Target
fcfa395be3fef8d2bbc4627554cc3a8310a11aae4e62fd07913542c5d0eadfee.dll
Size 899KB
Sample240426-j9xpascf53
SHA256 fcfa395be3fef8d2bbc4627554cc3a8310a11aae4e62fd07913542c5d0eadfee
MD5 3531f78dc5f11b13d42d6597a61e0bcb
SHA1 f6821cbb8e826a94642f928ecde1579faf301b5f
SHA512 5cdf5a5d6b8b4ed5a34e723612280615a169a9ac8035be3904a21766c3ee6163dd7a1856576aa694feab331cdfa1029f972cf85b4740d66db555dfdcb724d1d6
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX0:7wqd87V0
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1664	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 1664	4488	rundll32.exe	86
PID 4488 wrote to memory of 1664	4488	rundll32.exe	86
PID 4488 wrote to memory of 1664	4488	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcfa395be3fef8d2bbc4627554cc3a8310a11aae4e62fd07913542c5d0eadfee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcfa395be3fef8d2bbc4627554cc3a8310a11aae4e62fd07913542c5d0eadfee.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1664